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further information, please contact the IAEA at: Vienna International Centre, PO Box 100, 
1400 Vienna, Austria. 
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RELATED PUBLICATIONS 


The IAEA provides for the application of the standards and, under the terms of Articles 
III and УШ.С of its Statute, makes available and fosters the exchange of information 
relating to peaceful nuclear айм and serves as an intermediary among is Member States for ths 
purpose. 

Reports on safety in nuclear activities are issued as Safety Reports, which provide 
practical examples and detailed methods that can be used in support of the safety standards. 

Other safety related IAEA publications are issued as Emergency Preparedness and 
Response publications, Radiological Assessment Reports, the International Nuclear Safety 
Group’s INSAG Reports, Technical Reports and TECDOCs. The IAEA also issues reports 
on radiological accidents, training manuals and practical manuals, and other special safety 
related publications. 

Security related publications are issued in the IAEA Nuclear Security Series. 


The IAEA Nuclear Energy Series comprises informational publications to encourage 
and assist research on, and the development and practical application of, nuclear energy for 
peaceful purposes. It includes reports and guides on the status of and advances in technology, 
and on experience, good practices and practical examples in the areas of nuclear power, the 
nuclear fuel cycle, radioactive waste management and decommissioning. 
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FOREWORD 


The IAEA's Statute authorizes the Agency to “establish or 
adopt... standards of safety for protection of health and minimization of danger 
to life and property” — standards that the IAEA must use in its own operations, 
and which States can apply by means of their regulatory provisions for nuclear 
and radiation safety. The IAEA does this in consultation with the competent 
organs of the United Nations and with the specialized agencies concerned. A 
comprehensive set of high quality standards under regular review is a key 
element of a stable and sustainable global safety regime, as is the IAEA's 
assistance in their application. 

The IAEA commenced its safety standards programme in 1958. The 
emphasis placed on quality, fitness for purpose and continuous improvement 
has led to the widespread use of the IAEA standards throughout the world. The 
Safety Standards Series now includes unified Fundamental Safety Principles, 
which represent an international consensus on what must constitute a high 
level of protection and safety. With the strong support of the Commission 
on Safety Standards, the IAEA is working to promote the global acceptance and 
use of its standards. 

Standards are only effective if they are properly applied in practice. 
The IAEA’s safety services encompass design, siting and engineering safety, 
operational safety, radiation safety, safe transport of radioactive material and 
safe management of radioactive waste, as well as governmental organization, 
regulatory matters and safety culture in organizations. These safety services 
assist Member States in the application of the standards and enable valuable 
experience and insights to be shared. 

Regulating safety is a national responsibility, and many States have 
decided to adopt the IAEA’s standards for use in their national regulations. 
For parties to the various international safety conventions, IAEA standards 
provide a consistent, reliable means of ensuring the effective fulfilment of 
obligations under the conventions. The standards are also applied by regulatory 
bodies and operators around the world to enhance safety in nuclear power 
generation and in nuclear applications in medicine, industry, agriculture and 
research. 

Safety is not an end in itself but a prerequisite for the purpose of the 
protection of people in all States and of the environment — now and in the 
future. The risks associated with ionizing radiation must be assessed and 
controlled without unduly limiting the contribution of nuclear energy to 
equitable and sustainable development. Governments, regulatory bodies and 
operators everywhere must ensure that nuclear material and radiation sources 
are used beneficially, safely and ethically. The IAEA safety standards are 
designed to facilitate this, and I encourage all Member States to make use of 
them. 


THE IAEA SAFETY STANDARDS 


BACKGROUND 


Radioactivity is a natural phenomenon and natural sources of radiation are 
features of the environment. Radiation and radioactive substances have many 
beneficial applications, ranging from power generation to uses in medicine, 
industry and agriculture. The radiation risks to workers and the public and to the 
environment that may arise from these applications have to be assessed and, if 
necessary, controlled. 

Activities such as the medical uses of radiation, the operation of nuclear 
installations, the production, transport and use of radioactive material, and the 

management of radioactive waste must therefore be subject to standards of 

safety. Regulating safety is a national responsibility. However, radiation risks 
may transcend national borders, and international cooperation serves to promote 
and enhance safety globally by exchanging experience and by improving 
capabilities to control hazards, to prevent accidents, to respond to emergencies 
and to mitigate 

any harmful consequences. 

States have an obligation of diligence and duty of care, and are expected to 
fulfil their national and international undertakings and obligations. 

International safety standards provide support for States in meeting their 
obligations under general principles of international law, such as those relating 
to environmental protection. International safety standards also promote and 
assure confidence in safety and facilitate international commerce and trade. 

A global nuclear safety regime is in place and is being continuously 
improved. IAEA safety standards, which support the implementation of 
binding international instruments and national safety infrastructures, are 
a cornerstone of this global regime. The IAEA safety standards constitute 
a useful tool for contracting parties to assess their performance under these 
international conventions. 


THE IAEA SAFETY STANDARDS 


The status of the IAEA safety standards derives from the IAEA's 
Statute, which authorizes the IAEA to establish or adopt, in consultation 
and, where appropriate, in collaboration with the competent organs of the 
United Nations and with the specialized agencies concerned, standards of 
safety for protection of health and minimization of danger to life and 
property, and to provide for their application. 


With a view to ensuring the protection of people and the environment 
from harmful effects of ionizing radiation, the IAEA safety standards establish 
fundamental safety principles, requirements and measures to control the radiation 
exposure of people and the release of radioactive material to the environment, to 
restrict the likelihood of events that might lead to a loss of control over a nuclear 
reactor core, nuclear chain reaction, radioactive source or any other source of 
radiation, and to mitigate the consequences of such events if they were to occur. 
The standards apply to facilities and activities that give rise to radiation risks, 
including nuclear installations, the use of radiation and radioactive sources, the 
transport of radioactive material and the management of radioactive waste. 

Safety measures and security measures! have in common the aim of 
protecting human life and health and the environment. Safety measures and 
security measures must be designed and implemented in an integrated manner 
so that security measures do not compromise safety and safety measures do not 
compromise security. 

The IAEA safety standards reflect an international consensus on what 
constitutes a high level of safety for protecting people and the environment 
from harmful effects of ionizing radiation. They are issued in the IAEA Safety 
Standards Series, which has three categories (see Fig. 1). 


Safety Fundamentals 

Safety Fundamentals present the fundamental safety objective and 
principles of protection and safety, and provide the basis for the safety 
requirements. 


Safety Requirements 

An integrated and consistent set of Safety Requirements establishes 
the requirements that must be met to ensure the protection of people and the 
environment, both now and in the future. The requirements are governed by the 
objective and principles of the Safety Fundamentals. If the requirements are not 
met, measures must be taken to reach or restore the required level of safety. The 
format and style of the requirements facilitate their use for the establishment, in a 
harmonized manner, of a national regulatory framework. Requirements, 
including numbered ‘overarching’ requirements, are expressed as ‘shall’ 
statements. Many requirements are not addressed to a specific party, the 
implication being that the appropriate parties are responsible for fulfilling them. 


Safety Guides 
Safety Guides provide recommendations and guidance on how to comply 
with the safety requirements, indicating an international consensus that it 


' See also publications issued in the IAEA Nuclear Security Series. 
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FIG. 1. The long term structure of the IAEA Safety Standards Series. 


is necessary to take the measures recommended (or equivalent alternative 
measures). The Safety Guides present international good practices, and 
increasingly they reflect best practices, to help users striving to achieve high 
levels of safety. The recommendations provided in Safety Guides are expressed 
as ‘should’ statements. 


APPLICATION OF THE IAEA SAFETY STANDARDS 


The principal users of safety standards in IAEA Member States are 
regulatory bodies and other relevant national authorities. The IAEA safety 
standards are also used by co-sponsoring organizations and by many 
organizations that design, construct and operate nuclear facilities, as well as 
organizations involved in the use of radiation and radioactive sources. 

The IAEA safety standards are applicable, as relevant, throughout the 
entire lifetime of all facilities and activities — existing and new — utilized for 
peaceful purposes and to protective actions to reduce existing radiation risks. 
They can be 


used by States as a reference for their national regulations in respect of facilities 
and activities. 

The IAEA’s Statute makes the safety standards binding on the IAEA 
in relation to its own operations and also on States in relation to IAEA 
assisted operations. 

The IAEA safety standards also form the basis for the IAEA’s safety 
review services, and they are used by the IAEA in support of competence 
building, including the development of educational curricula and training 
courses. 

International conventions contain requirements similar to those in the 
IAEA safety standards and make them binding on contracting parties. The IAEA 
safety standards, supplemented by international conventions, industry 
standards and detailed national requirements, establish a consistent basis for 
protecting people and the environment. There will also be some special 
aspects of safety that need to be assessed at the national level. For example, 
many of the IAEA safety standards, in particular those addressing aspects of 
safety in planning or design, are intended to apply primarily to new facilities 
and activities. The requirements established in the IAEA safety standards might 
not be fully met at some existing facilities that were built to earlier standards. 
The way in which IAEA safety standards are to be applied to such facilities is 
a decision for individual States. 

The scientific considerations underlying the IAEA safety standards provide 
an objective basis for decisions concerning safety; however, decision makers 
must also make informed judgements and must determine how best to balance 
the benefits of an action or an activity against the associated radiation risks and 
any other detrimental impacts to which it gives rise. 


DEVELOPMENT PROCESS FOR THE IAEA SAFETY STANDARDS 


The preparation and review of the safety standards involves the IAEA 
Secretariat and five safety standards committees, for emergency preparedness 
and response (EPReSC) (as of 2016), nuclear safety (NUSSC), radiation safety 
(RASSC), the safety of radioactive waste (WASSC) and the safe transport of 
radioactive material (TRANSSC), and a Commission on Safety Standards (CSS) 
which oversees the IAEA safety standards programme (see Fig. 2). 

All IAEA Member States may nominate experts for the safety standards 
committees and may provide comments on draft standards. The membership of 
the Commission on Safety Standards is appointed by the Director General and 
includes senior governmental officials having responsibility for establishing 
national standards. 

A management system has been established for the processes of planning, 
developing, reviewing, revising and establishing the IAEA safety standards. 
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FIG. 2. The process for developing a new safety standard or revising an existing standard. 


It articulates the mandate of the IAEA, the vision for the future application of 
the safety standards, policies and strategies, and corresponding functions and 
responsibilities. 


INTERACTION WITH OTHER INTERNATIONAL ORGANIZATIONS 


The findings of the United Nations Scientific Committee on the Effects 
of Atomic Radiation (UNSCEAR) and the recommendations of international 
expert bodies, notably the International Commission on Radiological Protection 
(ICRP), are taken into account in developing the IAEA safety standards. Some 
safety standards are developed in cooperation with other bodies in the United 
Nations system or other specialized agencies, including the Food and Agriculture 
Organization of the United Nations, the United Nations Environment 
Programme, the International Labour Organization, the OECD Nuclear Energy 


Agency, the Pan American Health Organization and the World Health 
Organization. 


INTERPRETATION OF THE TEXT 


Safety related terms are to be understood as defined in the IAEA Safety 
Glossary (see http://www-ns.iaea.org/standards/safety-glossary.htm). Otherwise, 
words are used with the spellings and meanings assigned to them in the latest 
edition of The Concise Oxford Dictionary. For Safety Guides, the English 
version of the text is the authoritative version. 

The background and context of each standard in the IAEA Safety 
Standards Series and its objective, scope and structure are explained in Section 
1, Introduction, of each publication. 

Material for which there is no appropriate place in the body text 
(e.g. material that is subsidiary to or separate from the body text, is included 
in support of statements in the body text, or describes methods of calculation, 
procedures or limits and conditions) may be presented in appendices or annexes. 

An appendix, if included, is considered to form an integral part of the 
safety standard. Material in an appendix has the same status as the body text, 
and the IAEA assumes authorship of it. Annexes and footnotes to the main text, 
if included, are used to provide practical examples or additional information or 
explanation. Annexes and footnotes are not integral parts of the main text. 
Annex material published by the IAEA is not necessarily issued under its 
authorship; material under other authorship may be presented in annexes 
to the safety standards. Extraneous material presented in annexes is excerpted 
and adapted as necessary to be generally useful. 
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1. INTRODUCTION 


BACKGROUND 


1.1. This Safety Guide provides recommendations on the design of the 
reactor core to meet the requirements established in IAEA Safety Standards 
Series No. SSR-2/1 (Rev. 1), Safety of Nuclear Power Plants: Design [1]. This 
publication is a revision of IAEA Safety Standards Series No. NS-G-1.12', 
which it supersedes. 


OBJECTIVE 


1.2. The objective of this Safety Guide is to provide recommendations on 
meeting the safety requirements established in SSR-2/1 (Rev. 1) [1] for the 
design of the reactor core for nuclear power plants. 


SCOPE 


1.3. This Safety Guide is applicable primarily to land based stationary nuclear 
power plants with water cooled reactors for electricity generation or for other 
heat production (such as district heating or desalination). All recommendations 
are applicable to light water reactors (i.e. pressurized water reactors and 
boiling water reactors) and are generally applicable to pressurized heavy water 
reactors unless otherwise specified. This Safety Guide may also be applied, with 
judgement, to other reactor types (e.g. gas cooled reactors, floating reactors, 
small and modular reactors, innovative reactors) to contribute to the 
interpretation of the requirements that have to be considered in developing 
the design ofthe reactor core. 


1.4. The reactor core is the central part of a nuclear reactor where nuclear 
fission occurs. The reactor core consists of four basic systems and components 
(i.e. the fuel (including fuel rods and the fuel assembly structure), the coolant, 
the moderator and the control rods), as well as additional structures (e.g. reactor 
pressure vessel internals, core support plates, and the lower and upper internal 
structure in light water reactors). This Safety Guide addresses the safety aspects 


! INTERNATIONAL ATOMIC ENERGY AGENCY, Design of the Reactor Core 
for Nuclear Power Plants, IAEA Safety Standards Series No. NS-G-1.12, IAEA, Vienna 
(2005). 


of the core design and includes neutronic aspects, thermohydraulic aspects, 
thermomechanical aspects, structural mechanical aspects, aspects relating to 
reactor core control, shutdown and monitoring, and core management aspects 
for the safe design of the reactor core for nuclear power plants. Specifically, the 
following structures, systems and components (SSCs) are covered: 


(a) Fuel rods, containing fuel pellets with or without burnable absorbers in 
cladding tubes, which generate and transfer heat to the coolant. 

(b) Fuel assemblies, comprising bundles of fuel rods, along with structures and 
components (e.g. guide tubes, spacer grids, bottom and top nozzles, fuel 
channels) that maintain the fuel rods and fuel assemblies in a 
predetermined geometrical configuration. 

(c) The reactor core control system, the shutdown system and the monitoring 
system, including components and equipment used for reactivity control 
and shutdown, comprising neutron absorbers (solid or liquid), the 
associated structure and the drive mechanism. 

(d) Support structures that provide the foundation for the core within the 
reactor vessel (within the calandria for pressurized heavy water 
reactors), the structure for guiding the flow (for pressurized water 
reactors) and the guide tubes for reactivity control devices (for pressurized 
heavy water reactors). 

(e) The coolant. 

(f) The moderator. 

(g) Other core components such as steam separators (for boiling water 
reactors) and neutron sources. These are considered only to a limited 
extent in this Safety Guide. 


1.5. This Safety Guide is intended mainly for NPPs that use natural and enriched 
UO, fuels and plutonium-blended UO, fuel (mixed oxide fuel) with zirconium 
based alloy cladding. Unless otherwise specified, all recommendations apply to 
these fuel types. 


1.6. For innovative fuel materials, such as uranium nitride fuel or inert matrix 
fuel, or cladding materials other than zirconium based alloys, this Safety Guide 
can be applied with judgement. 


1.7. The design of the reactor core may interface with the design of other 
reactor systems and other related aspects. In this Safety Guide, recommendations 
on these interfacing systems and aspects are provided mainly to identify their 
functional interface. The relevant Safety Guides are referenced, as appropriate, 
in order to clarify the interfaces. 


1.8. The terms used in this Safety Guide are to be understood as defined in the 
IAEA Safety Glossary [2]. Explanations of additional technical terminology are 
provided in Annex I. 


STRUCTURE 


1.9. Section 2 describes general considerations for safe core design based on 
requirements for the management of safety, principal technical requirements 
and general design requirements established in sections 3, 4 and 5 of 
SSR-2/1 (Rev. 1) [1], respectively. Section 3 describes specific considerations 
for the safe design of fuel rods, fuel assemblies, core structures and core 
components, and the core control system and the reactor shutdown system 
based on specific design requirements (i.e. Requirements 43-46) of SSR-2/1 
(Rev. 1) [1]. Section 4 provides recommendations on the qualification and 
testing of the SSCs of the reactor core. 


1.10. Annex I provides supplementary technical information for clarification of 
the terminology used in this Safety Guide, additional background information 
and examples supporting specified design recommendations. Annex II describes 
important items that need to be addressed within the design of the fuel rod, fuel 
assembly, reactivity control assembly, neutron source assembly and 
hydraulic plug assembly. 


2. GENERAL SAFETY CONSIDERATIONS IN THE 
DESIGN OF THE REACTOR CORE 


MANAGEMENT SYSTEM 


2.1. The design of the reactor core should take into account the 
recommendations of IAEA Safety Standards Series Nos GS-G-3.1, Application 
of the Management System for Facilities and Activities [3], and GS-G-3.5, The 
Management System for Nuclear Installations [4] to meet Requirements 1-3 of 
SSR-2/1 (Rev. 1) [1], and the requirements of IAEA Safety Standards 
Series No. GSR Part 2, Leadership and Management for Safety [5]. 


DESIGN OBJECTIVES 
Fundamental safety functions 


2.2. The three fundamental safety functions, described in Requirement 4 of 
SSR-2/1 (Rev. 1) [1], are required to be ensured in the design of the reactor 
core for operational states and for a wide range of accident conditions. The 
fundamental safety functions as they apply specifically to the design of the 
reactor core are as follows: 


(a) Control of reactivity; 
(b) Removal of heat from the reactor core; 
(c) Confinement of radioactive material. 


Adequate design based on the concept of defence in depth 


2.3. Adequate design (i.e. capable, reliable and robust design) of the reactor 
core, based on the concept of defence in depth, will enable achievement of the 
fundamental safety functions, together with provision for associated reactor 
safety features. 


2.4. Physical barriers considered as part of, or affecting the design of, the 
reactor core include the fuel matrix, the fuel cladding and the boundary of the 
reactor coolant system. For normal operation and anticipated operational 
occurrences, fuel rods are required to be designed such that their structural 
integrity and a leaktight barrier are maintained to prevent the transport of 
fission products into the coolant (see Requirement 43 of SSR-2/1 (Rev. 1) [1]). 


2.5. For design basis accidents, fuel cladding failures should be kept to a 
minimum. Components of the reactor core and its associated structures should 
be designed with account taken of the safety functions to be achieved. In 
addition, the reactor core is required to be designed to maintain a configuration 
such that it can be shut down and remains coolable for design basis accidents 
and design extension conditions without significant fuel degradation (see 
Requirement 44 of SSR-2/1 (Rev. 1) [1]). 


Proven engineering practices 
2.6. The reactor core should be of a design that has been proven either in 


equivalent applications, by means of operating experience or the results of 
relevant research programmes, or, as appropriate, in accordance with the design, 


design verification and validation processes stated in applicable codes and 
standards (in accordance with paras 4.14 and 4.16 of SSR-2/1 (Rev. 1) [1]). 


Safety assessment in the design process 
2.7. Paragraph. 4.17 of SSR-2/1 (Rev. 1) [1] states (footnote omitted): 


"The safety assessments shall be commenced at an early point in the 
design process, with iterations between design activities and confirmatory 
analytical activities, and shall increase in scope and level of detail as the 
design programme progresses." 


Recommendations on safety assessment methods are provided in IAEA Safety 
Standards Series No. SSG-2 (Rev. 1), Deterministic Safety Analysis for Nuclear 
Power Plants [6]. 


Features to facilitate radioactive waste management 


2.8. The design of fuel rods and fuel assemblies should provide features that 
will facilitate future waste management (including reprocessing when 
applicable). The physical condition of discharged fuel assemblies from the 
reactor core will influence the design of the storage and disposal systems for 
the used fuel. Recommendations on taking into account the impact of the 
condition of used fuel on the design of spent fuel handling and storage systems 
are provided in IAEA Safety Standards Series Nos SSG-63, Design of Fuel 
Handling and Storage Systems for Nuclear Power Plants [7], and SSG-15 
(Rev. 1), Storage of Spent Nuclear Fuel [8]. 


DESIGN BASIS FOR STRUCTURES, SYSTEMS AND COMPONENTS 
OF THE REACTOR CORE 


2.9. In accordance with Requirement 14 of SSR-2/1 (Rev. 1) [1], the design 
basis for the reactor core is required to specify the necessary capability, 
reliability and functionality for all applicable plant states (see para. 2.10) in 
order to meet the specific acceptance criteria. 


Plant states and postulated initiating events 


2.10. As stated in Requirement 13 of SSR-2/1 (Rev. 1) [1], plant states are 
required to be identified and grouped into categories. The plant states typically 


considered for the design of the reactor core are normal operation, anticipated 
operational occurrences, design basis accidents and design extension conditions 
without significant fuel degradation. These four states are referred to as ‘all 
applicable plant states’ throughout this Safety Guide. Accidents with significant 
core melting are outside the scope of the design of the reactor core. 


2.11. The design process should include an analysis of the effects of 
postulated initiating events on the reactor core for all applicable plant states. 
Recommendations on the identification of the postulated initiating events 
for all applicable plant states and relevant safety analyses are provided in 
SSG-2 (Rev. 1) [6]. 


External hazards 


2.12. The consequences of earthquakes should be taken into account in the 
design of the reactor core. Seismic categorization of the SSCs of the reactor core 
should be determined in accordance with IAEA Safety Standards Series No. 
NS-G-1.6, Seismic Design and Qualification for Nuclear Power Plants [9]. 


Design limits 


2.13. Design limits on relevant physical parameters for individual SSCs of 
the reactor core are required to be specified for all applicable plant states, in 
accordance with Requirement 15 of SSR-2/1 (Rev. 1) [1]. Adherence to these 
limits with appropriate provisions will ensure that the concept of defence 
in depth, as stated in paras 2.4 and 2.5, is successfully applied with adequate 
margins. Typical examples of relevant parameters with quantitative or 
qualitative limits are provided in paras 3.33 and 3.65-3.76. 


Safety classification aspects of the reactor core 


2.14. The SSCs of the reactor core are required to be classified on the 
basis of their function and their safety significance (see Requirement 22 of 
SSR-2/1 (Rev. 1) [1]). The safety classification process is described in IAEA 
Safety Standards Series No. SSG-30, Safety Classification of Structures, Systems 
and Components in Nuclear Power Plants [10]. 


2.15. Fuel rods and fuel assemblies should be classified in safety class 1, the 
highest safety class, since they are essential for achieving the three fundamental 
safety functions in para. 2.2. 


2.16. The failure of control rods has the potential to endanger the control of 
reactivity in the core and the integrity of the fuel rods, which are safety class 1 
barriers; from this perspective, control rods should be classified in safety class 1. 


2.17. For all safety classes identified in accordance with the method 
described in SSG-30 [10], corresponding engineering design rules should be 
specified and applied. 


Engineering design rules 


2.18. The engineering design rules for the SSCs of the reactor core represent 
methods to achieve the adequacy of the design and should include the following, 
as appropriate: 


(a) The use of applicable codes and standards, and proven engineering 
practices; (D) ^ Conservative safety assessment; 

(c) Specific design analyses for reliability; 

(d) Qualification and testing; 

(e) Operational limits and conditions. 


Design for reliability 


2.19. In accordance with para. 5.37 of SSR-2/1 (Rev. 1) [1], fuel rods and 
assemblies, and components and systems for reactor control and shutdown are 
required to be designed with high reliability, in consideration of their safety 
significance. Provisions for achieving high reliability in these designs are set out 
in paras 3.39 and 3.112 of this Safety Guide, respectively. 


Operational limits and conditions 


2.20. In accordance with Requirement 28 of SSR-2/1 (Rev. 1) [1], operational 
limits and conditions are required to be established in order to ensure that the 
reactor core operates safely in accordance with design assumptions and intent. 
Relevant guidance on the operational limits and conditions is provided in IAEA 
Safety Standards Series No. NS-G-2 2, Operational Limits and Conditions and 
Operating Procedures for Nuclear Power Plants [11]. 


DESIGN FOR SAFE OPERATION 


2.21. The SSCs of the reactor core should be designed such that their required 
testing, inspection, repair, replacement, calibration or maintenance is facilitated. 


2.22. The design of the reactor core should be reviewed and modified when a 
significant configuration change occurs during the operating lifetime of the 
plant, as a result of, for example: 


(a) Major modifications to the plant design or to equipment, or operational 
modifications, such as the following: 

(1) Replacement of the steam generator (not for boiling water reactors); 
(ii) An increase in the rated power of the plant; 
(ii) A significant change in the operating domain. 

(b A new fuel type or a significant change in fuel type (e.g. the introduction 
of mixed oxide or gadolinium fuel, new design of the fuel rods or the fuel 
assembly with modified geometrical or thermohydraulic characteristics). 

(с) An increase of the fuel discharge burnup beyond the design limit. 

(d) Major fuel management changes such as a large extension to the length of 
the reloading cycle. 


2.23. Fuel rods and fuel assemblies should be designed to prevent the potential 
for fuel failures due to specific operational conditions (e.g. startup rates, 
degraded coolant chemistry conditions or the presence of foreign 
materials) during operational states. 


REACTOR CORE SAFETY ANALYSIS 


2.24. In accordance with Requirement 42 of SSR-2/1 (Rev. 1) [1], safety 
analysis is required to be conducted to evaluate and assess challenges to 
safety in all applicable plant states using deterministic approaches and including 
uncertainties to the extent possible. 


2.25. The following major factors should be taken into account in the safety 
analysis for the reactor core: 


(a) Initial operating conditions (e.g. global and local thermohydraulic 
conditions, power levels, power distributions and time in the reloading 
cycle); 

(b) Reactivity feedback; 


(c) Rate of change of the concentration of soluble absorber in the moderator 
and the coolant; 

(d) Position or rate of insertion of positive (or negative) reactivity regulated by 

the reactivity control device(s), or caused by changes in process parameters; 

(e) Rate of insertion of negative reactivity associated with a reactor trip; 

(f) The response of individual channels to transients in relation to the average 
thermal power of the core (for boiling water reactors); 

(g) Performance characteristics of safety system equipment, including the 
changeover from one mode of operation to another (e.g. from the injection 
mode for emergency core cooling to the recirculation mode); 

(h) The decay of xenon and other neutron absorbers in the analysis of the long 
term behaviour of the core; 

(1) The activity inventory of the core. 


Appropriate provisions or margins should be included in the above factors 
such that the safety analysis remains valid for specific loading patterns or 
fuel designs. Recommendations on methods of safety analysis are provided in 
SSG-2 (Rev. 1) [6]. 


2.26. Safety analysis for the reactor core should be performed to verify that 
fuel design limits are not exceeded in all applicable plant states. For accident 
conditions, the effect of fuel behaviour on core cooling should be included in 
the safety analysis (e.g. ballooning and rupture of the cladding, exothermic 
metal—water reactions, distortions of fuel rods and fuel assemblies). The effects 
of hydrogen accumulation (as a result of a metal—water reaction between the 
zirconium based alloy cladding and water at high temperature) on the boundary 
of the reactor coolant system should be evaluated. 


2.27. Systematic, complete, qualified and up to date documentation of the state 
of the SSCs of the plant and the reactor core should be maintained to ensure that 
the safety analysis is performed using the actual plant and core configuration. 


3. SPECIFIC SAFETY CONSIDERATIONS IN THE 
DESIGN OF THE REACTOR CORE 


GENERAL 


3.1. This section addresses specific design aspects for the SSCs of the reactor 
core for meeting Requirements 43-46 established in SSR-2/1 (Rev. 1) [1]. It 
also addresses the interface with core management, which strongly influences 
the core design with regard to the performance of fuel rods and fuel assemblies. 
Specific guidance is provided in IAEA Safety Standards Series No. NS-G-2.5, 
Core Management and Fuel Handling for Nuclear Power Plants [12]. 


3.2. The design of the reactor core, in combination with the design of reactor 
cooling systems, and the reactor control and reactor protection systems, should 
enable the fulfilment, at all times, of the fundamental safety functions (para. 2.2) 
for all applicable plant states (i.e. normal operation, anticipated operational 
occurrences, design basis accidents and design extension conditions without 
significant fuel degradation). 


3.3. The reactor core and associated control and protection systems should be 
designed with adequate margins to ensure that fuel design limits are not 
exceeded for all applicable plant states. Fuel design limits are described in paras 
3.65-3.76. 


Fuel type 


3.4. Fuel rods contain fissile materials (e.g. 230, Ри) that are highly 
reactive with thermal neutrons. In selecting the fuel pellet materials, the 
following properties should be optimized (examples of pellet materials are 
provided in Annex I): 


(a) Reactivity with thermal neutrons; 

(b) Impurities with low thermal neutron absorption properties; 

(c) Thermal performance (e.g. high thermal conductivity is desirable for 
operational states while high thermal diffusivity is desirable for accident 
conditions); 

(d) Dimensional stability; 

(e) Fission gas retention; 

(f) Resistance to pellet-cladding interaction. 
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3.5. Cladding materials should be selected with consideration of the following 
properties (examples of cladding materials are provided in Annex D): 


(a) Low absorption cross-section for thermal neutrons; 

(b) High resistance to irradiation conditions; 

(c) High thermal conductivity and high melting point; 

(d) High corrosion resistance and low hydrogen pick-up; 

(e) Low oxidation and low hydriding in high temperature conditions; 

(f) Adequate resistance to breakaway oxidation at high integrated-time 
temperature conditions; 

(g) Adequate mechanical properties (e.g. high strength, high ductility, low 
creep rate in normal operation, high relaxation rate in transients); 

(h) Low susceptibility to stress corrosion cracking; 

(i) Adequate resistance to hydrogen assisted cracking and hydride related 
cracking in normal operation and for fuel storage. 


Coolant 


3.6. In light water reactors, the coolant also acts as the moderator. The choice 
of coolant should take into account interactions between the coolant and fuel 
and core components in all chemical conditions (see Annex I for supplementary 
information). For pressurized heavy water reactors, the coolant and the 
moderator are separated; typically, chemicals are not added to the coolant for 
controlling reactivity. 


3.7. The coolant should be physically and chemically stable with respect both 
to high temperatures and to irradiation in order to fulfil its primary function, 
namely the continuous removal of heat from the core. 


3.8. The reactor core should be designed to prevent or control flow instabilities 
and the resultant fluctuations in core reactivity or power. 


3.9. The reactor fuel and core design should include the following safety 
considerations associated with the coolant: 


(a) Ensuring that the coolant system is free of foreign materials prior to the 
initial startup of the reactor and following refuelling and maintenance 
outages, for the operating lifetime of the plant; 

(b) Maintaining the radionuclide activity in the coolant as low as reasonably 
achievable by means of purification systems, corrosion product 
minimization or removal of defective fuel as appropriate; 
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(c) Monitoring and controlling the effects that the coolant and coolant 
additives have on reactivity in all plant states; 

(d) Determining and controlling the physical and chemical properties of the 
coolant in the core; 

(e) Ensuring that the chemical composition of the coolant is compatible with 
the materials that are present in the primary circuit (e.g. to avoid crud 
formation on fuel rods, and to minimize corrosion and the generation of 
radioactive products). 


3.10. The design should take into account the effect of changes in coolant 
density (including fluid phase changes) on core reactivity and core power, both 
locally and globally. 


Moderator 


3.11. The choice of moderator and of the spacing of the fuel rods and fuel 
assemblies within it should meet engineering and safety requirements with 
respect to reactivity feedback due to changes in moderator temperature, density 
or void fraction, while also optimizing the neutron economy and, hence, fuel 
consumption. The prevalent thermal reactor types use either light water or heavy 
water as the moderating medium. 


3.12. Depending on the reactor design, the moderator could contain a soluble 
neutron absorber, such as boron in pressurized water reactors, to maintain 
adequate shutdown margins in operational states and, by means of controlled 
dilution, to compensate the decrease in core reactivity throughout the whole 
reloading cycle. 


3.13. For pressurized heavy water reactors, the reactor core design should ensure 
the effectiveness of the shutdown system of the reactor in an accident involving 
dilution of the absorber. Means should be provided to prevent the inadvertent 
removal of such absorber material (e.g. due to chemistry transients) and to 
ensure that its removal is controlled and slow. 


3.14. For pressurized heavy water reactors, the moderator should provide 
the capability to remove decay heat without loss of core geometry in 
accident conditions. 


3.15. For pressurized heavy water reactors, measures should be provided 


to prevent deflagration or explosion of hydrogen generated by radiolysis 
in the moderator. 
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NEUTRONIC DESIGN 
Design considerations 


3.16. The design of the reactor core should ensure that the feedback 
characteristics of the core rapidly compensate for an increase in reactivity. The 
reactor power should be controlled by a combination of the inherent neutronic 
characteristics of the reactor core (see Annex I for supplementary information) 
and its thermohydraulic characteristics, and the capability of the control system 
and the shutdown system to actuate in all applicable plant states. 


3.17. The design should ensure that power changes that could result in 
conditions exceeding fuel design limits for normal operation and anticipated 
operational occurrences will be reliably and readily detected and suppressed. 


Nuclear design limits 
Nuclear key safety parameters 


3.18. Nuclear key safety parameters influencing the neutronic design of the core 
and fuel management strategies should be established from the safety analyses 
that verify compliance with the specific fuel design limits described in paras 
3.65-3.76. Appropriate provision should also be made for the nuclear key safety 
parameters, such that they will remain valid for specific core reload designs 
and throughout the reloading cycle. Typical nuclear key safety parameters 
include the following: 


(a) The temperature coefficients of reactivity for the fuel and the moderator; 

(b) The boron reactivity coefficient and concentration (for pressurized water 
reactors); 

(c) The shutdown margin; 

(d) The maximum reactivity insertion rate; 

(e) The control rod worth and control bank worth; 

(f) The radial and axial power peaking factors, including allowance for xenon 
induced oscillation; 

(g) The maximum linear heat generation rate; 

(h) The void coefficient of reactivity. 


3.19. The safety impacts of any major modifications (see para. 2.22) to the 
reactor core design should be assessed using the nuclear key safety parameters in 
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order to ensure that the specified fuel design limits are not violated. Otherwise, 
new nuclear key safety parameters should be defined and justified. 


Core reactivity characteristics 


3.20. On the basis of the geometry and the fuel composition of the reactor core, 
the design should include evaluations of the core to determine steady state 
spatial distributions of neutron flux and of the power, core neutronic 
characteristics and the efficiency of the means of reactivity control for normal 
operation of the plant at power, in shutdown conditions and in accident 
conditions. 


3.21. Nuclear key safety parameters, such as reactivity coefficients, should be 
evaluated for selected core operating conditions (e.g. zero power, full power, 
beginning of cycle, end of cycle and at key points relating to poison burnout) 
and for the corresponding fuel management strategy. The dependence of such 
nuclear key safety parameters on the core loading and on the burnup of the fuel 
should be analysed. Appropriate margins should be included in the reactivity 
coefficients or within the modelling approaches used to evaluate reactivity 
feedback in the safety analysis for all applicable plant states. 


Maximum reactivity worth and reactivity insertion rate 


3.22. The maximum reactivity worth of the reactivity control devices (e.g. 
control rods and/or chemical and volume control systems) should be limited, or 
interlock systems should be provided, so that any resultant power variations do 
not exceed specified limits for relevant reactivity insertion transients and 
accidents, such as the following: 


(a) Control rod ejection; 

(b) Control rod drop; 

(c) Boron dilution; 

(d) Uncontrolled withdrawal of control banks. 


Such reactivity limits should be determined via safety analyses to ensure that the 
fuel design limits described in paras 3.65-3.76 are not exceeded. These analyses 


should be performed for all fuel types in the core (e.g. UO, or mixed oxide fuel) 
or a representative core with appropriate margins, and for all allowable operating 


conditions and fuel burnup values. 
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Control of global and local power 


3.23. The design should ensure that the core power can be controlled globally 
and locally using the means of reactivity control (see Annex I for supplementary 
information) in such a way that the peak linear heat generation rate of each fuel 
rod does not exceed the specified limits anywhere in the core. Variations in the 
power distribution (e.g. caused by effects such as xenon instability) or other 
local effects (e.g. in a mixed core, crud induced power shifts or axial offset 
anomalies for pressurized water reactors, fuel assembly bowing or distortion) 
should be addressed in the design of the control system. Provisions should be 
included to take into account measurement variations between flux detectors 
(e.g. due to operability, location, shadowing or ageing). 


Shutdown margin 


3.24. The insertion of control rods should provide an adequate shutdown margin 
in all applicable plant states (see Annex I for supplementary information). The 
specification and monitoring of control rod insertion limits as a function of 
power level should ensure an adequate shutdown margin at all times to ensure 
satisfactory tolerance to faults. 


3.25. The effects of depletion of burnable absorber on the core reactivity should 
be evaluated to ensure an adequate shutdown margin in all resulting applicable 
core conditions throughout the operating cycle. (Examples of the use of burnable 
absorbers in pressurized water reactors are provided in Annex I.) 


THERMOHYDRAULIC DESIGN 
Design considerations 


3.26. The thermohydraulic design of the reactor core should include adequate 
margins and provisions to ensure the following: 


(a) Specified thermohydraulic design limits are not exceeded in operational 
states (i.e. in normal operation and anticipated operational occurrences); 

(b) The failure rates of fuel rods in design basis accidents and design extension 
conditions without significant fuel degradation remain within acceptance 
levels; 

(c) Minimum and maximum values of core flow rate are consistent with 
thermohydraulic design limits and mechanical design limits. 
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Thermohydraulic design limits 


3.27. Specific thermohydraulic design limits should be established with adequate 
margins for predictable parameters, such as the maximum linear heat generation 
rate, the minimum critical power ratio (for boiling water reactors), the minimum 
departure from nucleate boiling ratio (for pressurized water reactors) or the 
dryout power ratio (for pressurized heavy water reactors), the peak fuel 
temperature or enthalpy, and the peak cladding temperature. Uncertainties in 
the values of process parameters (e.g. reactor power, coolant flow rate, core 
bypass flow, inlet temperature and pressure, and power peaking factors), core 
design parameters and calculation methods used in the assessment of the thermal 
margins should be addressed in the design analyses. 


3.28. The thermohydraulic design should include design analyses that take into 
account design features of the fuel assembly, including the fuel rod spacing, the 
fuel rod power, the sizes and shapes of subchannels, spacer and mixing grids (for 
light water reactors), and flow deflectors (for light water reactors) or turbulence 
promoters. In addition, for fuel channel type pressurized heavy water reactors, 
the effects of fuel bundle string, appendages, gaps between fuel rods and the 
pressure tube, anticipated change in shape of the pressure tube with reactor 
ageing, and junctions between neighbouring end-plates should be addressed in 
the design analyses. 


3.29. For light water reactors, the thermohydraulic design should also consider 
core inlet and outlet coolant temperatures and flow distributions. These effects 
should also be considered in the core monitoring and protection systems. 


3.30. The design should ensure that the minimum ratio of operating power to 
critical power (1.e. a minimum critical heat flux ratio, a minimum departure from 
the nucleate boiling ratio, a minimum critical channel power ratio or a minimum 
critical power ratio) takes into account that critical heat flux correlations have 
been developed from representative tests performed at steady state conditions. 
As a consequence, adequate margins or provisions should be added to the 
minimum ratio to take into account additional factors not considered in the 
correlation itself, such as the following: 


(a) The thermohydraulic response to anticipated operational occurrences; 


(b) Impacts resulting from the chosen loading pattern; 
(c) Impacts resulting from the potential presence of crud in the core. 


16 


In addition, uncertainties, such as plant operational uncertainties and code 
uncertainties, should be adequately taken into account in the safety analysis. 


3.31. Critical heat flux limits should be applied in the safety analysis to ensure 
that the potential for cladding failure is avoided. In some reactor designs, critical 
heat flux conditions during transients can be tolerated if it can be shown, using 
suitable analytical methods, that the cladding temperatures will not exceed the 
fuel failure limits. 


3.32. Experiments should be conducted on representative fuel assembly designs 
over the range of expected operational states, including various axial heat flux 
profiles, to identify the limiting values of the minimum ratios. Correlations 
for predicting critical heat flux are continually being generated as a result of 
additional experimental data, changes in fuel assembly design and improved 
calculation techniques involving coolant mixing and the effect of axial power 
distributions. The impact of any change in an established correlation used in 
thermohydraulic design should be evaluated. For fast transients (e.g. rod ejection 
accidents), the correlations used may be reassessed as steady state conditions 
may not be sufficiently representative. 


3.33. Approaches, such as those in the following examples, should be taken to 
demonstrate the fulfilment of the recommendations in paras 3.27-3.32: 


(a) For pressurized water reactors, the limiting (minimum) value of departure 
from nucleate boiling ratio should be established such that the hot rod in 
the core does not experience any heat transfer deterioration during normal 
operation or anticipated operational occurrences with a 95% probability at 
the 95% confidence level. 

(b) For boiling water reactors and for some pressurized water reactors that do 
not comply with the recommendation in para. 3.33(a), the limiting 
(minimum) value of critical power ratio, the critical heat flux ratio or the 
departure from the nucleate boiling ratio should be established such that the 
number of fuel rods that experience heat transfer deterioration does not 
exceed a very small fraction (e.g. at most, 0.1%) of the total number of fuel 
rods in the core. 

(c) For pressurized heavy water reactors, if the maximum fuel cladding 
temperature remains below a certain limit (e.g. 600°C) and the duration of 
post-dryout operation is limited (e.g. less than 60 s), it is considered that 
the fuel deformation is small, so that fuel rods are not in contact with the 
pressure tube and will not cause a failure of the pressure tube. 
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THERMOMECHANICAL DESIGN OF FUEL RODS AND FUEL 
ASSEMBLIES 


Design considerations 


3.34. The design should ensure that the structural integrity of fuel assemblies 
(i.e. their geometry) and of fuel rods (i.e. their leaktightness) is maintained 
for normal operation and anticipated operational occurrences. For accident 
conditions (design basis accidents and design extension conditions without 
significant fuel degradation), the design should ensure no fuel rod failures 
where this is reasonably practicable; otherwise, only a limited number of fuel 
rod failures should be allowed. The allowable number of failed fuel rods may 
depend on the frequency and nature of the event. A coolable geometry of the 
core should be ensured by design for design basis accidents and design extension 
conditions without significant fuel degradation. In accident conditions, the level 
of radionuclide activity should be assessed to confirm that the dose limits for 
workers are not exceeded. 


3.35. For accident conditions involving the ballooning and rupture of the 
cladding, the dispersal of fuel fragments in the coolant should be prevented. 


3.36. The design of fuel rods (with or without burnable absorbers) and 
fuel assemblies should take into account the irradiation conditions and the 
environmental conditions (e.g. temperature; pressure; coolant chemistry; 
irradiation effects on fuel, cladding and fuel assemblies; static and dynamic 
mechanical loads, including flow induced vibration; and changes in the chemical 
characteristics ofthe constituent materials). 


3.37. Fuel rods and fuel assemblies should be designed to withstand handling 
loads during transport, storage, installation and refuelling operations. 


3.38. Annex II describes important aspects that are typically taken into 
account in the design of fuel rods and fuel assemblies, and of reactivity control 
assemblies, neutron source assemblies and hydraulic plug assemblies, including 
the irradiation and environmental conditions. 


3.39. The design should ensure that fuel rods and fuel assemblies are reliable 
throughout their lifetime, including during manufacturing, transport, handling, 
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in-core operation, storage and disposal, where applicable. Key contributors to 
fuel reliability should be addressed; important key contributors include the 
following: 


(a) Oversight of fuel fabrication; 

(b) Debris mitigation (exclusion of foreign materials); 

(c) Control of in-reactor power changes to limit excessive pellet-cladding 
interaction; 

(d) Control of crud and corrosion; 

(e) Prevention of grid-to-rod fretting (for light water reactors); 

(f) Fuel surveillance and inspection practices. 


Thermal and burnup effects on fuel rods 


3.40. In operational states, the design should ensure that the peak fuel 
temperature is lower than the fuel melting temperature by an adequate 
margin to prevent melting of the fuel, when appropriate provisions and 
uncertainties are considered. For design basis accidents (e.g. reactivity 
initiated accidents) and for design extension conditions without significant 
fuel degradation, incipient fuel melting can be allowed (e.g. fuel centreline 
melting limited to a small fraction of fuel pellet volume). The design and 
safety assessments should take into account the effects of fuel burnup on the 
fuel rod and fuel assembly properties (see Annex I for supplementary 
information). 


3.41. Straining of the cladding is caused by overpressure of internal gases in 
the fuel rod or by gaseous swelling of the fuel or thermal expansion of the fuel 
as a consequence of fuel burnup or local power increases. The design should 
ensure that cladding stresses and strains are limited. Limits for cladding stress, 
accumulated cladding strain, and cladding corrosion and hydriding should be 
specified for all applicable plant states and should be applied throughout the 
reloading cycle. 


3.42. For accident conditions, cladding deformation should be evaluated to 
determine the potential for cladding failure (e.g. burst or rupture) and any 
resulting release of fission products from the fuel. 


Effects of irradiation on fuel assembly structures 


3.43. The design should ensure that the dimensional changes of light water 
reactor fuel assembly structures are minimized so that contacts or interactions 
between the fuel rods and fuel assembly components (top and bottom nozzles 
of the fuel assembly) are precluded, and that bowing of the fuel rods and fuel 
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assemblies, as well as swelling of the control rods and any potential interaction 
with the fuel assembly guide tubes, will not affect the structural integrity or the 
thermohydraulic performance of the fuel assemblies or the safety functions of 
the control rods. 


3.44. Relaxation of grid springs under irradiation should be assessed to limit the 
potential for grid-to-rod fretting (for light water reactors). In the dimensional 
stability analyses for fuel assembly components and control devices, the effects 
of irradiation, and in particular the effects of fast neutrons, on mechanical 
properties, such as tensile strength, ductility, growth, creep or relaxation, 
should be taken into account. The effect of irradiation on buckling resistance of 
the spacer grids should be considered when assessing seismic events or loss of 
coolant accidents. 


3.45. For pressurized heavy water reactors, the design should ensure that 
the length of the cavity in the fuel channel is sufficient to accommodate the 
irradiation and thermal effects on the fuel bundle string in the fuel channel for all 
applicable plant states. 


Effects of variations in power levels 


3.46. For operational states, fuel rods should be designed to withstand 
thermomechanical loads during local and global power transients (e.g. loads 
due to fuel assembly shuffling, movements of control devices, load following, 
flexible operation or other causes of reactivity changes). 


Mechanical effects in fuel rods 


3.47. The design should include analyses to ensure that straining of the fuel 
cladding due to mechanical loads (e.g. coolant pressure, seismic loads) meets 
fuel design limits. The analyses should take into account radial gap closure 
kinetics, which depend on various parameters such as fuel densification, fuel 
swelling, fuel pellet cracking, fragmentation and its radial relocation within the 
fuel rod after a power change, cladding creep behaviour at low stress, initial 
internal pressure of the fuel rods, release of fission gases to the free volumes, 
and operating parameters including power history and coolant pressure. 


3.48. Stress corrosion cracking induced by pellet-cladding interaction in the 
presence of corrosive fission products should be prevented (see Annex I for 
supplementary information). 
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3.49. Stress concentration in the cladding, caused by missing pellets, axial gaps 
between fuel pellets, missing pellet surfaces or fuel pellet chips trapped in the 
gap, cannot be explicitly considered in the fuel rod design and, hence, those 
anomalies should be avoided to the extent possible. 


Effects of burnable absorber in the fuel 


3.50. The design should include analyses to demonstrate that the fuel rod can 
accommodate the effects of any in-fuel burnable absorbers on the thermal, 
mechanical, chemical and microstructural properties of the fuel pellets, and on 
the behaviour of the fuel rods. 


Corrosion and hydriding 


3.51. Hydrogen pick-up correlations should be determined as a function of the 
corrosion of the cladding in normal operation for each cladding type, so that 
appropriate fuel design limits, such as for reactivity initiated accidents and loss 
of coolant accidents, can be expressed as a function of the pre-transient 
hydrogen content of the cladding (see Annex I for supplementary information). 


3.52. Fuel rods and fuel assemblies should be designed to be compatible with the 
coolant environment in operational states, including shutdown and refuelling 
(see Annex I for supplementary information). 


3.53. For pressurized heavy water reactors, the initial hydrogen content in the 
fuel rods should be limited to reduce the likelihood of fuel defects being caused 
by hydrogen induced embrittlement of the cladding. 


Crud 


3.54. The design analyses should take into account the degradation of the heat 
transfer from fuel rods due to the formation of deposits on the surface of the 
cladding via corrosion products coming from the reactor coolant system or other 
chemical changes. For pressurized water reactors, in the event that boron is 
trapped in the crud layer, its potential impact on the neutronic performance of 
the core should be assessed and addressed in the core design analyses. 


Hydraulic effects in fuel assemblies 


3.55. Hydraulic effects should be addressed primarily in the thermohydraulic 
design of the fuel assembly and in the evaluation of aspects such as localized 
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corrosion, erosion, flow induced vibration, grid-to-rod fretting, fuel assembly 
lift-off and fuel assembly distortion. Hydraulic effects on the fuel assembly 
design should be characterized by means of fuel assembly endurance tests 
performed in qualified out-of-reactor loops using full scale fuel assembly 
mock-ups with prototypical test conditions (e.g. pressure, temperature, cross- 
flows and end-of-life grid spring relaxation). 


Considerations of mechanical safety in the design 


3.56. The fuel assembly should be designed to withstand mechanical stresses as a 
result of the following: 


(a) 
(b) 
(c) 


(d) 
(e) 
(f) 
(g) 
(h) 
(i) 
(j) 


Fuel handling and loading; 

Power variations; 

Hold-down loads for pressurized water reactors (which should balance the 
hydrodynamic lift-off forces and the geometrical changes of the core 
cavity and of the fuel assemblies under irradiation); 

Temperature gradients; 

Hydraulic forces, including cross-flows between distorted fuel assemblies 
or in mixed fuel core configurations (i.e. cores with different types of fuel); 
Irradiation effects (e.g. irradiation induced growth and swelling); 

Vibration and fretting wear of fuel rods (grid-to-rod fretting for light water 
reactors, wear between spacers for pressurized heavy water reactors) 
induced by coolant flow; 

Creep deformation of the fuel assembly structure (which could lead to 
distortion of fuel assemblies); 

Seismic loading at the level of the safety shutdown earthquake, typically 
combined with the loading due to loss of coolant accidents; 

Postulated initiating events (i.e. anticipated operational occurrences and 
design basis accidents) and design extension conditions without significant 
fuel degradation. 


3.57. For all applicable plant states, the following mechanical safety aspects 
should be addressed in the design of fuel rods and fuel assemblies: 


(a) 
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The clearance within and adjacent to the fuel assembly should provide 
space to allow for irradiation induced growth and bowing (for light water 
reactors) and bulging of the fuel channel (for boiling water reactors; see 
Annex I for supplementary information). 


(b) Bowing of fuel rods or distortion of assemblies should be limited, so that 
thermohydraulic behaviour, power distribution, fuel performance and fuel 
handling are not adversely affected. 

(c) Fatigue should not cause the failure of any component of the fuel 

assembly.(d) Fuel assembly distortion as a result of mechanical and hydraulic 

hold-down forces and in-core cross-flows should be limited to a level that 

does not impact the local critical heat flux margins. In addition, the fuel 

assembly distortion should not impair the insertion of the reactivity control 

assembly 

(e.g. there should be no increase of drop time in pressurized water reactors) 

to ensure safe reactor shutdown for all applicable plant states (for light 
water reactors). 

(e) Vibration and fretting damage should not affect the overall performance of 
the fuel assembly and its support structure. 

(f | Hydraulic and mechanical loads (including those resulting from a safety 
shutdown earthquake) should not cause the failure of any component of the 
fuel assembly. 


3.58. For accident conditions (design basis accidents and design extension 
conditions without significant fuel degradation), the design should prevent any 
interaction between fuel rods or fuel assemblies and fuel assembly support 
structures that would impede safety systems from performing their functions as 
specified in the safety analysis. In particular, the following should be ensured: 


(a) Proper functioning of the components of safety systems (e.g. shutdown 
devices and their guide tubes for pressurized water reactors); 
(b) Proper cooling of the core. 


Fuel pellet-cladding interaction 


3.59. The design should ensure that no fuel cladding failure takes place due to 
pellet-cladding mechanical interaction in normal operation and anticipated 
operational occurrences (see Annex I for supplementary information). The 
design of the fuel rods and plant specific guidelines for power changes in normal 
operation and anticipated operational occurrences should ensure that excessive 
pellet-cladding mechanical interaction is prevented. 


3.60. In design basis accidents that lead to rapid power transients (e.g. a 
reactivity initiated accident), the fuel cladding can fail due to excessive 
pellet-cladding mechanical interaction combined with cladding embrittlement 
due to in-reactor hydriding at high burnup levels. Fuel failures corresponding to 
this failure mode should be considered in safety analysis. 
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3.61. The design should ensure that the likelihood of stress corrosion cracking in 
the fuel cladding is minimized in normal operation and anticipated operational 
occurrences (see Annex I for supplementary information). 


3.62. Stress corrosion cracking of the fuel cladding should be prevented 
by implementing adequate design methods such as those given in the 
following examples: 


(a) Reduce tensile stresses in the fuel cladding by restricting rates of power 
change (allowing for the cladding stresses to relax) or by delaying the time 
at which the pellet-cladding gap closes (this can be achieved by increasing 
the initial fill gas pressure in the fuel rod or by optimizing the creep 
properties of the cladding). 

(b) Reduce the corrosive effects of the fission products (e.g. iodine, cadmium, 
caesium) generated by the pellet by using a liner (for boiling water 
reactors) or a graphite coating (for pressurized heavy water reactors) 
that is less susceptible to the corrosive effects on the inner surface of the 
cladding. This liner can also even out local stress concentrations in the 
cladding. 

(c) Reduce the availability of corrosive fission products at the pellet-cladding 
interface by using additive fuels that are able to better retain the corrosive 
fission gas products within the fuel matrix. 

(d) Reduce local power peaking factors (and, thus, changes in local linear heat 
generation rates) through core design techniques. 


3.63. The power-ramp failure threshold should be established, if applicable, in 
test reactors by means of power-ramp tests for each type of fuel or cladding. 
The data collected should cover the entire burnup range (see Annex I for 
supplementary information). 


3.64. Fuel performance analysis codes can be used to analyse and interpret the 
data from power-ramp tests and to determine a failure threshold. The parameter 
used to define this threshold is usually the maximum cladding stress but the 
strain energy density can also be used. These same fuel performance analysis 
codes can be used to assess risk factors that cause this type of stress corrosion 
cracking of fuel rods in the reactor core and to define adequate guidelines to 
avoid it. 


Fuel design limits 
3.65. Fuel design limits should be established based on all physical, chemical 


and mechanical phenomena that affect the performance of fuel rods and fuel 
assemblies for all applicable plant states. 
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Design limits for operational states 


3.66. For normal operation and for anticipated operational occurrences, the 
design of fuel rods should address at least the following limitations throughout 
the whole reloading cycle: 


(a) 
(b) 


(c) 
(d) 


(e) 
(f) 
(g) 


No melting occurs in any location within the fuel pellets; 

No cladding overheating occurs (e.g. no departure from nucleate boiling 
for pressurized water reactors, critical power ratio below limits for boiling 
water reactors and no dryout condition for pressurized heavy water 
reactors); 

Fuel cladding does not collapse (light water reactor fuel only); 

The internal pressure of the fuel rods does not increase to the extent that 
cladding deformations caused by it would negatively affect the heat 
transfer between the fuel pellets and the coolant (1.e. there is no reopening 
of the fuel pellet-cladding gap by cladding lift-off); 

Fuel cladding corrosion and hydriding do not exceed specified limits; 
Cladding stress and strain remain below specified limits; 

Reduction of the cladding wall thickness (e.g. through wear or erosion) 
does not exceed specified limits. 


3.67. Components of fuel rods and fuel assemblies for light water reactors 
should be designed to maintain low deformation and growth so that the 
following are ensured: 


(a) 


(b) 
(c) 


(d) 
(e) 


No geometrical interaction between the fuel rods and fuel assembly top 
and bottom nozzles occurs (in order to avoid bowing of fuel rods and fuel 
assemblies for light water reactors). No geometrical interaction between the 
fuel bundle string and the shield plugs occurs (for pressurized heavy water 
reactors). 

No abnormal local power peaking occurs in the fuel rods. 

No degradation of the critical heat flux performance of the fuel assembly 
Occurs. 

Reactor scram or other movement of control rods is not impeded. 

The handling of fuel assemblies is not hampered. 


3.68. To prevent fuel cladding failure caused by pellet-cladding mechanical 
interaction, possibly assisted by stress corrosion cracking, appropriate operating 
limits on power changes and power-ramp rates of change should be determined 
such that the power-ramp failure thresholds are not exceeded. 
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3.69. The fuel assembly, other reactor vessel internals and the reactor cooling 
system should be designed to minimize the risk of any obstruction of the coolant 
flow due to a release of loose parts or debris, so as to prevent fuel damage in 
operational states. 


3.70. Fuel discharge burnup limits, which depend on the performance of the 
fuel rods and fuel assembly, and on the fuel management approach, should be 
assessed and justified accordingly. 


Design limits for design basis accidents and design extension conditions without 
significant fuel degradation 


3.71. For design basis accidents and design extension conditions without 
significant fuel degradation, the following should be ensured: 


(a) For accident sequences in which some fuel rod failures cannot reasonably 
be avoided, the number of fuel rod failures should not exceed a small 
percentage of the total number of fuel rods in the reactor core to minimize 
the radiological consequences of the accident under consideration. 

(b) In determining the total number of fuel rod failures, all known potential 
failure mechanisms should be evaluated. Chemical reactions, including 
oxidation and hydriding, cladding ballooning or collapse of the cladding, 
or damage to the cladding caused by an increase in the fuel enthalpy, are 
some of the failure mechanisms that should be considered. 

(c) Limits applied in assessing the risk for loss of cladding integrity should be 
based on experimental studies. In determining the limits, chemical, 
physical, hydraulic and mechanical factors affecting the failure 
mechanisms, as well as the dimensional tolerances of the fuel rods, should 
be comprehensively and conservatively evaluated. When fuel failure 
mechanisms and fuel failure limits are burnup dependent, irradiation 
effects on cladding and fuel properties should be considered in the 
experimental studies and should be incorporated into the analyses to 
ensure that the application of the experimental results is comprehensive. 

(d) Fuel failure is considered to occur if the radial average enthalpy of a fuel 
rod at any axial location, calculated with validated tools, exceeds a certain 
value to be determined based on representative experimental results by 
appropriately adjusting test conditions to represent in-reactor conditions 
(test parameters to take into account include the coolant temperature, 
coolant pressure, coolant flow rate, reactivity insertion kinetics and fuel 
rod internal pressure). Since the mechanical resistance of the cladding 
changes with irradiation and may vary from one cladding type to another, 
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the reactivity initiated accident failure limit is expected to be dependent on 
the fuel burnup and on the cladding material. 


3.72. The ability to cool the core should not be endangered in the event 
of the following: 


(a) 
(b) 
(c) 


Excessive ballooning or bursting of the fuel rods (e.g. in a loss of coolant 
accident); 

Significant deformation of fuel assembly components or reactor internals 
(e.g. in a seismic event); 

Flow blockage or other consequences of fuel dispersal and fuel coolant 
interaction as a result of fuel cladding failure (e.g. in a reactivity initiated 
accident). 


The design of fuel rods should also be adequate to prevent undesired 
consequences of reactivity initiated accidents that may cause damage to the 
reactor coolant pressure boundary or damage that impairs the capability to cool 
the core. This is generally ensured by means of limits on the maximum fuel 
enthalpy and on the allowable increase in fuel enthalpy. 


3.73. To ensure that the structural integrity of the fuel rods is preserved, the 
following design limits should be defined and justified: 


(a) 


(b) 


(c) 


The peak cladding temperature in accident conditions should not exceed a 
level at which cladding oxidation causes excessive cladding embrittlement 
or accelerates uncontrollably. In addition, for light water reactors, effects 
on the peak cladding temperature due to fuel fragmentation and its axial 
relocation within the ballooned area of the fuel rod should be assessed as 
appropriate. Possible effects of the dispersal of fuel particles on doses to 
workers and on core coolability should also be addressed. 

The total oxidation of the cladding should remain below limits such that the 
cladding can still withstand accident induced loadings (e.g. in the 
quenching phase of a loss of coolant accident). Such limits should be 
determined by experiments that take into account pre-transient in- 
reactor cladding oxidation and transient oxidation (outer side oxidation 
and possibly inner side oxidation), pre-transient and transient hydrogen 
absorption, as well as chemical interactions between the fuel pellets and 
cladding material. 

The allowable enthalpy rise for reactivity initiated accidents should be 
limited to values that take into account initial fuel rod conditions (e.g. pre- 
transient hydrogen content of the cladding and fuel burnup). 
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(d) Ifapplicable, fuel септе пе melting should be limited to a small fraction 
of fuel pellet volume. 

(e) Fuel rods should be designed to withstand loadings resulting from 
post-transient fuel assembly handling, storage and transport to a 
reprocessing or disposal facility. 


3.74. For light water reactors, the amount of hydrogen generated by the chemical 
reaction between the coolant and the cladding during a loss of coolant accident 
should not exceed a fraction (e.g. 1%) of the amount of hydrogen that would be 
generated under the assumption that all claddings surrounding the fuel pellets in 
the reactor core (excluding the cladding surrounding the plenum volume) react 
with the coolant. 


3.75. In the event that fuel cladding failures during a reactivity initiated accident 
cannot be prevented, the dispersal of molten fuel particles should not challenge 
the ability to cool the core. 


3.76. Structural deformations of fuel rods, fuel assemblies, control rods and 
reactor internals should remain limited, so as to avoid any impairment of the 
movement of control rods in the reactor. In addition, melting temperatures 
should not be exceeded in the control rods at any time or in any location. 


MECHANICAL DESIGN OF CORE STRUCTURES AND COMPONENTS 
Design considerations 


3.77. The reactor core structures and components should be designed to maintain 
their structural integrity for all applicable plant states, under various damage 
mechanisms caused by, for example: vibration (mechanical vibration or flow 
induced vibration) and fatigue; debris effects; thermal, hydraulic and mechanical 
loads (e.g. loss of coolant accidents and seismic events); and chemical and 
irradiation. effects (including radiation induced growth). (See Annex I for 
supplementary information.) 


3.78. Of particular concern are damage to reactivity control devices and 
shutdown devices, and damage to the reactor coolant pressure boundary. The 
effects of high pressures, high temperatures, temperature variations and the 
temperature distribution, corrosion, radiation absorption rates and the 
lifetime radiation exposure on physical dimensions, mechanical loads and 
material properties should be addressed. 
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3.79. In addition, solid reactivity control devices should also be designed to 
withstand handling loads during refuelling operations, transport and storage. 


3.80. Important items that are typically addressed within the design of the 
reactivity control assembly, neutron source assembly and hydraulic plug 
assembly are described in Annex II. 


3.81. The design of the support structures in the core should provide adequate 
safety margins for thermal stresses generated in all applicable plant states 
and should take into account additional effects induced by gamma heating on 
their cooling and thermal responses. The chemical effects of the coolant and 
the moderator on these structures, which include corrosion, hydriding, stress 
corrosion and crud buildup, should also be addressed. 


3.82. Provision for the inspection of the core components and associated 
structures should be included in the design of the fuel assembly, control rods and 
guide structures, and the fuel assembly support structures. 


3.83. In light water reactors, the core support structures comprise tube sheets, a 
core barrel and support keys, which maintain the fuel assembly support 
structures in the desired geometrical position within the core cavity. These 
core support structures and fuel assembly support structures should be designed 
to withstand static and dynamic loads including those induced by refuelling and 
fuel handling. 


3.84. The structures and guide tubes for the shutdown and reactivity control 
devices, and for instrumentation should be designed such that these devices and 
instrumentation cannot be moved by inadvertent operator actions, strains on 
equipment, hydraulic forces due to coolant flow, or movements of bulk 
moderator for all applicable plant states. The design should facilitate the 
replacement of these devices and instrumentation. The design should consider 
the possibility that flow induced vibration of these devices, instruments or 
their guide tubes may result in fretting, wear and consequent failure in long 
term operation. The need for dimensional stability of the guide structures over 
their lifetime should also be addressed in the design. 


3.85. In the case of shutdown and reactivity control devices immersed in a bulk 
moderator (e.g. for pressurized heavy water reactors), the design should be able 
to accommodate the effects of hydraulic forces on these structures. 
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3.86. The design should facilitate the replacement of the reactivity control and 
shutdown devices without causing damage to other reactor core components, 
unacceptable insertion of reactivity, or excessive radiation exposures of workers. 


3.87. Depending on the reactor type, various other structures might be installed 
within the reactor vessel. These include, for example, feedwater spargers, 
steam separators, steam dryers, core baffles, reflectors and thermal shields. The 
functions of these internal structures include flow distribution for the reactor 
coolant, separation of steam and moisture, and protection of the reactor vessel 
from the effects of gamma radiation heating and neutron irradiation. These 
structures should be designed in accordance with paras 3.77-3.81, so that their 
mechanical performance does not jeopardize the performance of any reactor core 
safety functions throughout their service life. 


Design limits for the mechanical design of core structures and components 


3.88. The design of core structures and components should meet limits specified 
in the applicable codes and standards that are selected in accordance with the 
safety class (see paras 2.15-2.17). 


REACTOR CORE CONTROL, SHUTDOWN AND MONITORING 
SYSTEMS 


Reactor core control system 


3.89. This section describes important considerations for the control system 
for maintaining the shapes, levels and stability of the neutron flux within 
specified limits in all applicable plant states, in order to meet Requirement 45 of 
SSR-2/1 (Rev. 1) [1]. 


3.90. Paragraph 6.4 of SSR-2/1 (Rev. 1) [1] states that “Adequate means of 
detecting the neutron flux distributions in the reactor core and their changes shall 
be provided for the purpose of ensuring that there are no regions of the core in 
which the design limits could be exceeded.” 


3.91. The core design should allow for the installation of the necessary 
instrumentation and detectors for monitoring the core parameters, such as the 
core power (level, distribution and time dependent variation), the conditions and 
physical properties of the coolant and moderator (flow rate and temperature), 
and the expected effectiveness of the means of reactor shutdown (e.g. the 
insertion 
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rate of the absorber devices compared with their insertion limits), so that any 
necessary corrective action can be taken. The instrumentation should monitor 
relevant parameters over their expected ranges for all applicable plant states 
including during refuelling. 


Reactivity control devices 


3.92. The means of control of reactivity should be designed to enable the 
power level and the power distribution to be maintained within safe operating 
limits. This includes compensating for changes in reactivity to keep the process 
parameters within specified operating limits, such as those associated with: 


(a) Normal power manoeuvres; 

(b) Changes in xenon concentration; 

(c) Effects relating to temperature coefficients; 

(d) Rate of flow of coolant, or changes in coolant (or moderator) temperature 
and density; 

(e) Depletion of fuel and of burnable absorber; 

(f) Cumulative neutron absorption by fission products. 


3.93. Reactivity control devices should be capable of maintaining the reactor in 
a subcritical condition, with consideration given to design basis accidents and 
their consequences. Provisions should be included in the design to maintain 
subcriticality for plant states in which normal shutdown, fuel cooling or the 
integrity of the primary cooling system is temporarily disabled (e.g. when the 
reactor vessel is open for maintenance or refuelling in light water reactors). 


3.94. The types of reactivity control device used for regulating the core reactivity 
and the power distribution for different reactor designs are described in Annex I. 


3.95. The use of control rods or systems as the means of reactivity control for 
normal operation should not adversely affect their capability and efficiency 
required to execute fast reactor shutdown. 


3.96. The maximum degree of positive reactivity and its rate of increase by 
insertion in all applicable plant states are required to be limited or compensated 
for to prevent any resultant failure of the pressure boundary of the reactor 
coolant systems, to maintain the capability for cooling and to prevent any 
significant damage to the reactor core (see para. 6.6 of SSR-2/1 (Rev. 1) [1]). 
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3.97. The arrangement, grouping, speed of withdrawal and withdrawal sequence 
of the reactivity control devices, used in conjunction with an interlock system, 
should be designed to ensure that any abnormal withdrawal of the devices does 
not cause the specified fuel limits to be exceeded. Such abnormal withdrawal of 
the reactivity control devices should be addressed in the safety assessment. 


3.98. Reactivity control systems using a soluble absorber should be designed to 
prevent any unanticipated decrease in the concentration of absorber in the core 
that could cause specified fuel limits to be exceeded. Those parts of systems 
that contain soluble absorbers, such as boric acid, should be designed to prevent 
precipitation (e.g. by heating of the components; see IAEA Safety Standards 
Series No. SSG-56, Design of the Reactor Coolant System and Associated 
Systems in Nuclear Power Plants [13]). The concentrations of the soluble 
absorber in all storage tanks should be monitored. Whenever enriched boron 
(B) is used, appropriate monitoring should be provided. 


3.99. A detailed functional analysis of the alignments and operational conditions 
of the control systems should be performed to identify any potential for 
inadvertent dilution of boron in operation and in shutdown conditions, and to 
ensure the adequacy of preventive and recovery measures. Such preventive 
measures may include permanent administrative locking (of valves or parts 
of circuits), active isolation actions, interlocks of external injection systems, 
monitoring of boron concentrations in connected vessels or piping systems, and 
interlocks for starting recirculation pumps. 


3.100. The effectiveness of reactivity control devices, such as neutron absorber 
rods, should be verified by direct measurement. 


3.101. Paragraph 6.5 of SSR-2/1 (Rev. 1) [1] states that “In the design of 
reactivity control devices, due account shall be taken of wear out and of the 
effects of irradiation, such as burnup, changes in physical properties and 
production of gas.” 


3.102. In particular, the following environmental effects should be addressed in 
the design of control systems: 


(a) Irradiation effects such as depletion of the absorber material or swelling 


and heating of materials due to neutron and gamma absorption. Control 
rods should be replaced or exchanged accordingly. 
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(b) Chemical effects such as corrosion of the reactivity control devices. The 
transport of activated corrosion products through the reactor coolant 
system and moderator system should also be addressed. 

(c) Changes in structural dimensions, such as dimensional changes or 
movements of internal core structures due to temperature changes, 
irradiation effects or external events such as earthquakes, should not 
prevent the insertion of the reactivity control devices. 


Reactor shutdown system 


3.103. This section describes important considerations for systems designed 
to bring the reactor to a subcritical state from all applicable plant states, 
and to maintain it in this state, in accordance with Requirement 46 of 
SSR-2/1 (Rev. 1) [1]. Requirement 61 of SSR-2/1 (Rev. 1) [1] for the 
protection system also applies to the reactor shutdown system. 


3.104. The reactor shutdown system should ensure that, for all applicable 
plant states, design limits for the shutdown margin (paras 3.24 and 3.25) are not 
exceeded. The necessary reliability should be ensured through the design of the 
equipment. In particular, the design should ensure the necessary independence 
between plant processes and control and protection systems. 


3.105. Paragraph 6.7 of SSR-2/1 (Rev. 1) [1] states that “The effectiveness, 
speed of action and shutdown margin of the means of shutdown of the reactor 
shall be such that the specified design limits for fuel are not exceeded.” 
Recommendations on the rate of shutdown are provided in paras 3.106-3.108. 


3.106. The rate of shutdown should be adequate to render the reactor subcritical 
with an adequate margin, so that the specified design limits on fuel and on the 
reactor system pressure boundary are met. 


3.107. In designing for or evaluating the rate of shutdown, the following factors 
should be addressed: 


(a) The response time of the instrumentation to initiate the shutdown. 
(b) The response time of the actuation mechanism of the means of shutdown. 
(c) The location of the shutdown devices (depending on the chosen reactor 
core 
design). 
(d) The ease of entry of the shutdown devices into the core. This can be 
achieved by the use of guide tubes or other structural means to facilitate the 
insertion 
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of devices, including the possible incorporation of flexible couplings to 
reduce rigidity over the length of the devices. 
(e) The insertion speed of the shutdown devices. One or more of the following 
can be used to deliver the necessary insertion speed: 
() Gravity drop of shutdown rods into the core; 
(ii) | Hydraulic or pneumatic pressure drive of shutdown rods into the 
core; (iii) Hydraulic or pneumatic pressure injection of soluble neutron 
absorber. 


3.108. Means of checking the insertion speed of shutdown devices should 
be provided. The insertion time should be checked regularly (typically, at the 
beginning of each cycle) and possibly during the cycle if the margins to the 
limits are not sufficient. 


3.109. Paragraph 6.8 of SSR-2/1 (Rev. 1) [1] states: 


"[n judging the adequacy of the means of shutdown of the reactor, 
consideration shall be given to failures arising anywhere in the plant that 
could render part of the means of shutdown inoperative (such as failure of 
a control rod to insert) or that could result in a common cause failure." 


Generally, in assessing the failure of a control rod to insert, it should be assumed 
that the most reactive core conditions arise when the shutdown device that has 
the highest reactivity worth cannot be inserted into the core (i.e. the assumption 
that one shutdown device is stuck). 


Different means of shutdown 


3.110. Paragraph 6.9 of SSR-2/1 (Rev. 1) [1] states that “The means for 
shutting down the reactor shall consist of at least two diverse and independent 
systems." In addition, para. 6.10 of SSR-2/1 (Rev. 1) [1] states “At least one 
of the two different shutdown systems shall be capable, on its own, of 
maintaining the reactor subcritical by an adequate margin and with high 
reliability, even for the most reactive conditions of the reactor core.” 


3.]11. Table 1 provides typical examples that illustrate the diversity of 
the means of shutdown for three different reactor types (boiling water 
reactors, pressurized water reactors and pressurized heavy water reactors). 
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TABLE 1. MEANS OF SHUTDOWN FOR DIFFERENT REACTOR TYPES 


Reactor type Fast shutdown system Diverse shutdown system 

Boiling B,C in steel tubes or hafnium plates Boron solution injected 

water reactor (or a hybrid design) into the moderator or 
coolant 

Pressurized Ag-In-Cd in steel tubes or В,С Boron solution injected 

water reactor in steel tubes, hafnium rods into the moderator or 
coolant 


Pressurized heavy Cadmium rods sandwiched and sealed G 
water reactor between stainless steel tubes moving in 


adolinium solution 
injected into low pressure 


ie T ide t s 
zirconium alloy guide tubes moderator 


* This shutdown system can also act as another fast shutdown system. 


Reliability 


3.112. The design should include the following measures to achieve a 
high reliability of shutdown by means of each the following measures, or a 
combination of these as appropriate: 


(a) 


(b) 
(c) 


(d) 


(e) 


(f 


Adopting systems with uncomplicated design and simple operation, and 
with automatic activation. 

Selecting equipment of proven design. 

Using a fail-safe design as far as practicable (see Annex I for 
supplementary information). 

Giving consideration to the possible modes of failure and adopting 
redundancy in the activation of the shutdown systems (e.g. sensors). 
Provision for diversity may be made, for example, by using two different 
and independent physical trip parameters for each accident condition as far 
as practicable. 

Functionally isolating and physically separating the shutdown systems 
(this includes the separation of control and shutdown functions) as far as 
practicable, on the assumption of credible modes of failure and including 
common cause failure. 

Ensuring ease of entry of the means of shutdown into the core, with 
consideration of the in-core environmental conditions for operational states 
and accident conditions within the design basis. 
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(g) Designing to facilitate maintenance, in-service inspection and operational 
testability. 

(h) Providing means for performing comprehensive testing during 
commissioning and periodic refuelling or maintenance outages. 

(i) Testing of the actuation mechanism (or of partial rod insertion, if feasible) 
during operation. 

(j) Designing to function under extreme conditions (e.g. earthquakes). 


3.113. In the design of shutdown systems, as stated in para. 6.5 of 
SSR-2/1 (Rev. 1) [1], wear out of the control rod cladding and the effects of 
irradiation, such as burnup, changes in physical properties and production 
of helium gas are required to be taken into account. The recommendations in 
para. 3.102 are also applicable to the design of shutdown systems. Specific 
recommendations for diverse shutdown systems injecting neutron absorbers into 
the reactor coolant system are provided in SSG-56 [13]. 


Effectiveness of the shutdown system 
3.114. Paragraph 6.11 of SSR-2/1 (Rev. 1) [1] states: 


"The means of shutdown shall be adequate to prevent any foreseeable 
increase in reactivity leading to unintentional criticality during the 
shutdown, or during refuelling operations or other routine or non-routine 
operations in the shutdown state." 


The requirements for long term shutdown and deliberate actions that increase 
reactivity in the shutdown state (e.g. the movement of absorbers for maintenance 
purposes, the dilution of the boron content and refuelling actions) should be 
identified and evaluated to ensure that the most reactive condition is addressed 
in the criticality analysis. 


3.115. The design should determine the number and the reactivity worth of 
shutdown rods by considering various factors. Important factors to be taken into 
account include: 


(a) The core size. 

(b) The fuel type and the core loading scheme. 

(c) The required margin of subcriticality. 

(d) Assumptions relating to failure of a shutdown device or devices. 

(e) Uncertainties associated with the calculations. 

(f) Shutdown device shadowing (see Annex I for supplementary information). 
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(g) The most reactive core conditions after shutdown. These are associated 
with a number of parameters such as: 

(i) The most reactive core configuration (and, where appropriate, the 
corresponding boron concentration) that will occur during the whole 
reloading cycle, including during refuelling; 

(1) The most reactive credible combination of fuel and moderator 
temperatures; 

(ii) The amount of positive reactivity insertion resulting in design basis 
accident conditions; 

(iv) The amount of xenon as a function of time after shutdown; 

(у) Burnup of the absorber. 


3.116. The effectiveness of the shutdown system should be demonstrated: 


(a) Inthe design, by means of calculation; 

(b) During commissioning and prior to startup after each refuelling, by means 
of appropriate neutronic and process measurements to confirm the 
calculations for the given core loading; 

(c) During reactor operation, by means of measurements and calculations 
covering the actual and anticipated reactor core conditions. 


These analyses should cover the most reactive core conditions, and should 
include the assumption of the failure of the shutdown device(s). In addition, the 
shutdown margin should be maintained if a single random failure occurs in the 
shutdown system. 


3.117. If the operation of the reactor shutdown system is manual or partly 
manual, the necessary prerequisites for manual operation should be met (see 
IAEA Safety Standards Series No. SSG-39, Design of Instrumentation and 
Control Systems for Nuclear Power Plants [14]). 


3.118. Part of the means of shutdown may be used for the purposes of 
reactivity control and flux shaping in normal operation. Such use should not 
jeopardize the functioning of the shutdown system under any condition in all 
applicable plant states. 


3.119. The shutdown system should be testable, as far as practicable, during 
operation in order to provide assurance that the system is available on demand. 
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Separation of protection systems from control systems 


3.120. As stated in Requirement 64 of SSR-2/1 (Rev. 1) [1], protection systems 
are required to be physically and functionally separated from control systems 
to avoid failures of control systems causing failures in the protection system. 
Guidance on separation of the protection system from other systems is provided 
in SSG-39 [14]. 


Partial trip system 


3.121. In some reactor designs, when measured core parameters 
(e.g. temperatures, pressures, levels, flows and flux) exceed certain plant design 
limits, a partial trip system can be activated for protection of the reactor. If 
applicable, the design should ensure that a partial trip triggered by any 
anticipated operational occurrence transient does not allow specified fuel 
design limits to be exceeded. 


Operating limits and set points 
Operating limits for the control system 


3.122. The design should include operating limits and associated set points for 
actions, alarms or reactor trip to ensure that the operating power distributions 
remain within the design power distributions. 


3.123. Limits and set points should consider the impacts of fuel burnup, 
shadowing effects and coolant stratification (coolant temperature distribution). 


3.124. Determination of the operating limits and set points should include 
effects of the ageing of the reactor coolant system (e.g. steam generator tube 
plugging in pressurized water reactors, and an increase of the diameter of the 
pressure tube in pressurized heavy water reactors). 


Set points for reactor core protection 


3.125. Set points should be established and used to control or shut down the 
reactor at any time during operation. The automatic initiation of control and 
protection systems during a reactor transient should prevent damage to the fuel 
and, in the early stages of a reactor accident, should minimize the extent of 
damage to the fuel. 
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3.126. Equipment performance requirements and operating limits, and 
procedures should be defined to prevent excessive control rod worth or reactivity 
insertion rates. Their capability should be demonstrated. Where feasible, an 
alarm should be installed to function when any such limit or restriction is 
violated or is about to be violated. 


3.127. The design limits, uncertainties, operating limits, instrument 
requirements and set points should be stated in technical specifications to be 
used by facility operators. 


Core monitoring system 


3.128. In accordance with Requirement 59 of SSR-2/1 (Rev. 1) [1], core 
monitoring instrumentation is required to be provided to support the reactor 
protection and control systems, as well as to supply sufficiently detailed and 
timely information on the local heat generation conditions prevailing in the core. 
The core design should accommodate the detectors and devices for monitoring 
the magnitude and changes of core power, as well as the local distribution of 
heat generation in the core, in order to enable any required modification of core 
parameters (e.g. the insertion position of control rods, neutron flux, reactor 
coolant temperature and pressure) within their defined operating ranges. The 
speed of the variation in a parameter should determine whether the actuation of 
the reactor control systems is to be automatic or manual. 


3.129. In addition, radionuclide activity levels in the coolant should be 
monitored to assess the integrity of the fuel system during operation and to 
verify that design limits or operational limits are not exceeded. 


3.130. Appropriate parameters should be selected for core monitoring. This 
selection will depend on the reactor type. The following are examples of 
parameters to be measured for the purposes of core monitoring: 


(a) Spatial distribution of the neutron flux and related power distribution 
peaking factors; 

(b) Pressure of the reactor coolant system; 

(c) Coolant temperature (e.g. inlet temperature and outlet temperature); 

(d) Speed of the reactor coolant pump; 

(e) Water level (for light water reactors); 

(f) Radionuclide activity in the coolant (see Annex I for supplementary 
information); 

(g) Insertion position of the control rods; 
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(h) Concentration of soluble boron or B content when enriched boron is used 
(for a pressurized water reactor). 


3.131. Other safety related parameters may be derived from the measured 
parameters. Examples of such safety related parameters include the following: 


(a) Neutron flux doubling time; 

(b) Rate of change of the neutron flux; 

(c) Axial and radial neutron flux imbalances; 

(d) Reactivity balance; 

(e) Thermohydraulic core parameters (e.g. core thermal power, linear heat 
generation rate, reactor coolant flow rate, the departure from nucleate 
boiling ratio or the critical power ratio). 


3.132. The accuracy, speed of response, range and reliability of all monitoring 
systems should be adequate for performing their intended functions (see 
SSG-39 [14]). The design of the monitoring system should provide for the 
continuous or adequate periodic testing of these systems. 


3.133. Guidance on post-accident monitoring is provided in SSG-39 [14]. If 
core monitoring is necessary in accident conditions, for example, to monitor 
system temperatures, the reactor vessel water level or reactivity, the 
instrumentation to be used should be qualified to withstand the environmental 
conditions to be expected during and following the accident. 


3.134. The spatial power distribution should be monitored by means of ex-core 
or in-core instrumentation (such as neutron detectors and gamma thermometers). 
Measurements of the local power at different positions in the core should be 
performed to ensure that adequate safety margins are maintained considering 
the impact of the spatial power distribution changes due to core control effects 
and core burnup effects. The in-core power distribution should be monitored 
routinely. Detectors should be adequately distributed in the core to reliably 
detect the local changes in power density. Both ex-core and in-core neutron 
detectors should be calibrated periodically. 


3.135. A computerized core monitoring system should be used to ensure that 
the status of the core is within the operational limits assumed in the safety 
analysis. Qualification of the system should be ensured to a level consistent with 
the safety category of the functions performed, wherever it is coupled to a 
protection system (see SSG-39 [14]). 
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3.136. During reactor shutdown, a minimum set of instruments or combination 
of instruments and neutron sources should be available to monitor neutron flux 
and heat generation distribution (e.g. using flux detectors with an adequate 
sensitivity) whenever fuel assemblies are present in the reactor vessel, including 
during fuel loading and startup phases. 


3.137. During reactor startup in some reactors, a combination of interlocks on 
flux monitoring systems and reactivity control devices is used to ensure that the 
most appropriate monitors are used for particular flux ranges and to avoid undue 
reactor trips. The design of such interlock systems should be consistent with the 
design of the reactor protection system. 


3.138. During reactor startup, and especially during the first startup, the neutron 
flux is very low relative to that in full power operation, so more sensitive 
neutron detectors may be necessary temporarily to monitor the neutron flux. A 
neutron source may be necessary to increase the flux to a level that is within 
the range of the startup neutron flux monitors. The design of such 
neutron sources should ensure that: 


(a) The sources function properly to provide sufficient signals from the 
neutron flux monitors over their planned lifetime; 

(b) The sources are compatible with the fuel assemblies and the fuel assembly 
support structures. 


CORE MANAGEMENT 

Design considerations 

3.139. The primary objective of core management is to ensure the safe, reliable 
and optimum use of the fuel in the reactor, while remaining within operational 
limits and conditions. 

3.140. Each reloading cycle should be designed with appropriate means 


of controlling the core reactivity and the power distribution to address fuel 
design limits. 
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3.141. While the details of core management depend on the reactor type, in all 
cases, the core management programme should provide the following: 


(a) Means to perform core management functions effectively throughout the 
reloading cycle so as to ensure that core parameters remain within core 
management design limits. Core management functions include core 
design (specification of loading and shuffle patterns of fuel assemblies to 
provide optimum fuel burnup and desired fluxes), procuring fuel 
assemblies, reactivity determinations and core performance monitoring. 

(b) Core operating strategies that permit operating flexibility and good fuel 
utilization while remaining within core management design limits. 


Core design 


3.142. To achieve the desired core reactivity and power distribution for 
reactor operation, the operating organization should be provided with the 
following information: 


(a) Loading patterns (including enrichment and configuration of fuel rods) 
and orientation of fuel assemblies in each reloading cycle (for light water 
reactors); 

(b) Schedule for the subsequent unloading and loading of fuel assemblies; 

(c) Configurations of reactivity control and shutdown devices; 

(d) Burnable absorbers and other core components to be discharged, inserted 
or adjusted. 


3.143. Parameters associated with depletion of fuel and burnable absorber, 
and other reactor physics parameters are provided as inputs to safety analyses, 
plant monitoring and protection systems, and operator guidance. Thus, these 
parameters should be analysed based on predetermined plant operating 
objectives and resultant plans. These reactor physics parameters include the 
reactor startup conditions (e.g. critical boron concentrations and control rod 
positions, reactor kinetics, fuel temperature coefficients, moderator 
temperature coefficients, control rod and control bank worths, and power 
peaking factors). 


3.144. Unplanned power manoeuvring during flexible operation may alter the 
power and burnup profile across the core. As such, predictions of parameters 
associated with depletion of fuel and burnable absorber and other nuclear 
parameters should be continuously or periodically examined and evaluated, 
using relevant monitoring parameters. 
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3.145. The design of the reactor core should include analyses to demonstrate 
that the fuel management strategy and the established limitations on operation 
are such that the nuclear design limits and, hence, the fuel design limits will be 
met during the whole reloading cycle. 


3.146. Multidimensional and multiscale physics codes and system 
thermohydraulic codes should preferentially be used for realistic analysis of the 
reactor core for all applicable plant states. Uncertainties should be adequately 
incorporated into the analyses (see SSG-2 (Rev. 1) [6] for details). 


3.147. The reactor core analysis should be performed based on typical cases 
covering the whole reloading cycle for the following reactor core conditions: 


(a) Full power, including representative power distributions; 

(b) Load following (as applicable); 

(c) Approach to criticality and power operation; 

(d) Power cycling; 

(e) Startup; 

(f)  Refuelling; 

(g) Shutdown; 

(h) Anticipated operational occurrences; 

(i) Operation at the thermohydraulic stability boundary (for boiling water 
reactors). 


Whenever the management of fuel in the core is changed or any characteristics 
of the fuel rods (such as the fuel enrichment, fuel rod dimensions, fuel rod 
configuration or the fuel cladding material) are changed, a new reactor core 
analysis should be performed and documented. 


3.148. The reactor core analysis should include analyses of the performance 
of the fuel rods based on average and local power levels, and axial temperature 
distributions to demonstrate that the respective thermal and mechanical fuel 
design limits are met for all operational states. For light water reactors, the 
reactor core analysis should include analyses of peak channel power and peak 
linear power rates for normal full power operation and steady state radial power 
distribution at each fuel assembly location, and axial power distributions in each 
fuel assembly. Allowance should be made to take into account the effects of 
changes in the geometry of the fuel assembly on its neutronic and 
thermohydraulic performance (e.g. changes in the moderator gap thickness 
due to bowing of the assembly). The reactor core analysis should also include 
the radial power distribution within 
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a fuel assembly and the axial power distortion due to spacers, grids and other 
components in order to identify hot spots and to evaluate the local power levels. 


Refuelling 


3.149. For on-power refuelling in pressurized heavy water reactors, the 
effects of the refuelling operation on the neutronic behaviour of the core 
should be demonstrated to remain within the control capability of the reactor 
control systems. 


3.150. Safety assessment should address any event that could cause inadvertent 
criticality during core loading or unloading and during handling phases. 


3.151. The fuel loading sequence should be monitored through the use of in- 
core (for boiling water reactors) or ex-core flux distribution measurements, or 
by means of special administrative measures. The fuel loading pattern after 
reloading should be validated through the measurement of the flux distribution. 


3.152. For light water reactors, the reactor core should be designed such that 
the consequences of the worst misloaded fuel assembly, if any, remain within 
nuclear design limits and fuel design limits. If a misloaded fuel assembly can be 
prevented by special measures and equipment, the effectiveness and reliability of 
these precautionary measures should be demonstrated. Computational analyses 
should be performed if it cannot be demonstrated that the specified 
precautionary measures are sufficient. 


Core management design limits 


3.153. The reactor core analysis should verify that the core fuel loading pattern 
will meet the fuel design limits for all applicable plant states. 


3.154. For practical reasons and simplicity, for light water reactors, a system 
that develops and monitors the nuclear key safety parameters (see para. 3.130) 
can be used to verify the suitability ofthe reload core design. 

Special core configurations 


Mixed core 


3.155. When fuel assemblies of different types are loaded into the core (a 
“mixed core’), all fuel assembly types should meet the fuel design limits for all 
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applicable plant states. An assessment should be performed for the initial loading 
and subsequent reloading of mixed cores. It should include the dimensional, 
mechanical and thermohydraulic response of the various fuel types (e.g. in 
terms of pressure drop characteristics through the fuel assembly or assemblies 
and flow rate), the compatibility of each fuel assembly with the neutronic 
and thermohydraulic characteristics of the original core and with the related 
safety analyses. The critical heat flux or critical power correlation used in the 
core monitoring system should be valid for all fuel assembly types present in 
the mixed core. 


3.156. Relevant nuclear key safety parameters, such as reactivity, reactivity 
coefficients, control rod worth and power distributions, should be evaluated for 
the different fuel assembly designs. The evaluation of the compatibility of fuel 
assemblies may be developed based on calculations for single type fuel 
assemblies with appropriate provisions to cover all fuel assemblies. The 
combined effects on the related core-wide parameters should be evaluated. 


Mixed oxide fuel core 


3.157. The design of a mixed oxide core should include analyses to ensure that 
the nuclear design limits (for both initial loading and subsequent reloading) and 
the fuel design limits are met for all applicable plant states. In the analyses, the 
following considerations should be addressed: 


(a) The properties of mixed oxide fuel (see Annex I for supplementary 
information) are somewhat different from those of UO, fuel and this should 
be incorporated into computer codes and models used for the fuel design 
and safety analyses. 

(b) Ina mixed oxide core, the control rod worth and absorber worth are 
reduced as a result of neutron spectrum hardening owing to the higher 
thermal absorption cross-sections of plutonium compared with uranium, 
and, as a result, the reactor shutdown margin can be reduced. To 
compensate for the reduced shutdown margin, additional control rods 
should be available for insertion or additional absorption capability of the 
absorbing materials (e.g. an increase in B enrichment) should be 
implemented. 

(c) The kinetic parameters for mixed oxide fuel, namely the total fraction of 
delayed neutrons and the prompt neutron lifetime, are lower than those for 

UO, fuel. The lower delayed neutron fraction of mixed oxide fuel can 
result in a prompt critical reactor condition with a smaller reactivity 
insertion; 

thus, there is less time for control rod insertion or boron system injection to 
provide reactivity control. This should be addressed in the core design and 
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safety analyses for all applicable plant states (e.g. reactivity initiated events 
as anticipated operational occurrences and design basis accidents). 

(d) The fission cross-sections in mixed oxide fuel are larger than those in 
UO, fuel, and this can result in steep flux gradients between adjacent 
mixed oxide and UO, fuel rods. This effect can be reduced by varying the 
plutonium content and by adjusting the loading pattern in the core design. 
Other consequences of the differences in cross-section between plutonium 
and uranium are changes in the moderator temperature coefficient, the fuel 
temperature coefficient and the coefficient of reactivity for coolant voids. 
The core design and safety analyses should evaluate the effects of these 
changes in reactivity coefficients. 


Load following and power manoeuvring 


3.158. The effects of operating conditions, such as load following (see Annex I 
for supplementary information), power cycling, reactor startup and refuelling 
manoeuvring, should, whenever specified, be superimposed onto the power 
level distributions and temperature histories to evaluate the potential effects of 
thermal cycling on fuel rod thermomechanical responses, such as the buildup 
of pressure due to fission gas release to the pellet-cladding gap and due to fuel 
cladding fatigue. 


3.159. Once the extent of the desired flexibility is determined, an in depth 
evaluation of impacts on the design and operation of the nuclear power plant 
(i.e. requirements on the safety analysis and the operational limits and 
conditions) should be performed. Based on this evaluation, additional 
specifications for qualification and implementation can be developed. 


3.160. To ensure the control of core reactivity with load following and power 
manoeuvring, the core and generator power balance and the reactor stability 


should be maintained. 


3.161. The operational limits should be adjusted to cover perturbations due to 
load following operation (see Annex I for supplementary information). 


Reactor operation with leaking fuel rods 
3.162. Fuel rod failures can affect ease of access, work scheduling and worker 


dose for plant operations personnel. Operation of a reactor core with defective 
fuel rods should stay within the radiochemical requirements (see Annex I for 
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supplementary information) as defined by the limit on coolant radionuclide 
activity included in the technical specifications for the plant. 


3.163. The core design and operations programme should establish procedures 
and limits for operating the core with defective fuel assemblies while ensuring 
that dose constraints for workers are not exceeded. In light water reactors, 
the reactors should be shut down if the operating radiochemical limits are 
exceeded, and all defective fuel assemblies should be replaced in accordance 
with procedures during the outage. In pressurized heavy water reactors, fission 
product release from defective fuel and, subsequent, secondary hydriding of the 
cladding can be minimized by reducing the power level of defective fuel rods. 
(See Annex I for supplementary information.) 


Core redesign after fuel assembly repair 


3.164. In light water reactors, fuel assemblies containing damaged and leaking 
fuel rods may be repaired and reconstituted with replacement rods, dummy rods 
or vacancies. The use of vacancies should be limited so that design limits are 
met. 


3.165. The impact of a reconstituted fuel assembly on the design of the reactor 
core should be assessed. 


Impact of fuel design and core management on fuel handling, transport, 
storage, reprocessing and disposal 


3.166. Design limits are determined, based on the concept of defence in depth, 
to meet safety requirements for all applicable plant states. The fuel design limits 
described in paras 3.65-3.76 should be extended to ensure that the fuel rods 
and fuel assemblies remain intact (when applicable) or do not degrade further 
(in the case of leaking fuel rods) in the back end of the nuclear fuel cycle after 
the assemblies are discharged from the core. The back end of the fuel cycle 
includes handling, transport, storage, reprocessing and disposal. The following 
fuel performance parameters are among those that may have an impact on the 
post-irradiation behaviour of the fuel rods and the fuel assemblies: 


(a) Internal pressure of fuel rods at the end of life 


Even though fuel rods can withstand some extent of overpressurization 
exceeding the normal coolant pressure without failure in normal operation, 
the handling of such highly pressurized used fuel rods might not be 
acceptable when coolant counter-pressure is diminished (e.g. in spent fuel 
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(b) 


(c) 


(d) 
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storage facilities). This is particularly relevant for mixed oxide fuels that 
remain at a higher temperature for a longer period of time and continue to 
release helium gas from the fuel material. 


Massive cladding hydriding and cladding mechanical properties 


Localized hydriding (e.g. due to spalling of the corrosion layer or due to 
axial pellet-pellet gaps) might not take place during normal operation or 
be of consequence in accident conditions, but such a condition may lead 
to delayed hydride cracking of zirconium based alloy cladding in post- 
irradiation handling or storage, or undesired failures in the event of a 
transport accident. 


Fretting wear 


Localized wear (i.e. grid-to-rod fretting wear for light water reactors, 
spacer-to-spacer fretting wear for pressurized heavy water reactors) is 
usually undetected unless it wears completely through the cladding wall 
and creates a leakage pathway. Some fuel rods affected by excessive wear 
may exhibit localized weakness that may lead to long term creep failures 
or other mechanical failures in the event of a transport accident. 


Fuel discharge burnup 


Fuel design, core management and the resultant fuel discharge burnup 
affect the fuel isotopic vector, which, in turn, will impact the economy of 
fuel reprocessing or disposal. High fuel discharge burnups degrade fuel 
isotopic compositions and, therefore, affect reactivity. In mixed oxide 
fuel, the plutonium content should be adjusted to maintain parity with the 
reactivity of the UO, fuel present in the core, up to the anticipated fuel 
discharge burnup level. 


Other aspects 


New fuel rod designs or new fuel assembly designs, proposed by the fuel 
vendors to address other in-reactor issues (e.g. stress corrosion cracking 
of fuel cladding, fission gas release, fuel assembly distortion and fuel 
performance in accident conditions), should remain compatible with 
requirements relating to the back end of the nuclear fuel cycle. 


4. QUALIFICATION AND TESTING 


GENERAL 


4.1. The safe operation of the reactor core throughout the lifetime of the SSCs 
of the reactor core, including the fuel rods and assemblies, core components and 
control systems, necessitates a robust programme for qualification, inspection 
and testing of the equipment design and analysis process. This can be achieved 
as described in this section of the Safety Guide. 


DESIGN QUALIFICATION 


4.2. A qualification programme should confirm the capability of the reactor 
core SSCs to perform their function for the relevant time period, with account 
taken of the appropriate functional and safety considerations under prescribed 
environmental conditions (e.g. pressure, temperature, radiation levels, 
mechanical loading and vibration). These environmental conditions should 
include the variations expected in normal operation, anticipated operational 
occurrences, design basis accidents and design extension conditions 
without significant fuel degradation. 


4.3. The characteristics of certain postulated initiating events may preclude 
the performance of realistic commissioning tests and recurrent tests that could 
confirm that SSCs would perform their intended safety functions when called 
upon to do so, for example in the case of an earthquake. For the SSCs concerned 
and the events considered, a suitable qualification programme should be planned 
and performed prior to their installation. 


4.4. Methods of qualification should include: 


(a) Performance of a type test on the SSCs representative of those to be 
supplied; (b) Performance of a test on the SSCs supplied; 

(c) Use of pertinent past experience; 

(d) Analysis based on available and applicable test data; 

(e) Any combination of the above methods. 


4.5. Design qualification may be established through operating experience 


with fuel systems of the same or similar design. The basis for the previous 
experience should be identified and the performance record should be evaluated. 
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The maximum burnup and operating experience of the core at power should 
be referenced, and the performance of the fuel assemblies should be compared 
against design criteria identified for phenomena such as fretting wear, oxidation, 
hydriding, crud buildup and bowing of fuel assemblies. 


INSPECTION 


4.6. A system should be designed to allow the identification of each fuel 
assembly and to ensure its proper orientation within the core. Following initial 
loading of the fuel and any reloading, the locations and orientation of each fuel 
assembly should be inspected to verify correct location and positioning. 


TESTING INCLUDING PROTOTYPE ASSEMBLIES AND LEAD USE 
ASSEMBLIES 


4.7. Provisions should be made in the design for in-service testing and 
inspection to ensure that the core and its associated structures and the reactivity 
control and shutdown systems will perform their intended functions throughout 
their lifetime. Further guidance on in-service inspection is provided in IAEA 
Safety Standards Series No. NS-G-2.6, Maintenance, Surveillance and In-service 
Inspection in Nuclear Power Plants [15]. 


4.8. Out-of-reactor tests should be performed on fuel assembly prototypes, 
when practical, to determine the characteristics of a new design. The following 
out-of-reactor tests are generally performed for this purpose: 


(a) For light water reactors: 

(i) Spacer grid tests (including pressure drop tests, crush strength tests 
and other structural tests such as seismic resistance tests); 

(11) Control rod structural and performance tests; 

(ii) Fuel assembly structural tests (lateral, axial and torsional stiffness, 
and frequency and damping); 

(iv) Fuel assembly hydraulic flow tests, including the determination of 
pressure drop and fuel assembly lift-off force, control rod vibration 
and wear, fuel assembly vibration, grid-to-rod fretting (with account 
taken of the relaxation of spacer grid springs), and evaluations of the 
wear and the lifetime of fuel assemblies; 

(v) Fuel assembly thermohydraulic tests, including the determination of 
critical heat flux correlations. 


50 


(b) 


4.9. 


For pressurized heavy water reactors: 

(i) Fuel bundle string pressure drop tests; 

(п) Cross-flow endurance tests; 

(ii) Mechanical endurance tests; 

(iv) Bundle impact tests; 

(v) Bundle strength tests; 

(vi) Wear tests; 

(vii) Seismic qualification tests; 

(viii) Wash-in and wash-out tests (where applicable); 
(ix) Critical heat flux tests. 


In-reactor testing of design features through irradiation of fuel rods or 


fuel assemblies in materials test reactors or through irradiation of lead use fuel 
assemblies in power reactors should be used to justify the specified maximum 
burnup limit for a new design. The following phenomena may be tested 
in this manner: 


(a) 
(b) 
(c) 


(d) 
(e) 
(f) 
(g) 
(h) 
(i) 
() 
(k) 
(I) 


Fuel and burnable absorber rod growth; 

Fuel rod bowing; 

Fuel rod, spacer grid and fuel channel (if present) oxidation and hydride 
levels; 

Fuel rod fretting and spacer (for pressurized heavy water reactors) fretting; 
Fuel assembly growth; 

Fuel assembly bowing; 

Fuel channel (for boiling water reactors) wear and distortion; 

Fuel rod ridging (i.e. pellet-cladding interaction); 

Fuel rod integrity; 

Hold-down spring relaxation (for pressurized water reactors); 

Spacer grid spring relaxation (for light water reactors); 

Control rod and guide tube wear (for pressurized water reactors). 


4.10. In cases where in-reactor testing of a new fuel assembly design or a new 
design feature cannot be performed, special attention should be given to 
analytical evaluations and to augmented inspection or surveillance plans to 
validate the fuel design capability and performance features. 
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Annex I 


SUPPLEMENTARY TECHNICAL INFORMATION 


I-1. Table I-1 provides supplementary technical information to clarify the 
meaning of terms that are not defined in the IAEA Safety Glossary [I-1] but that 
are used in this Safety Guide, and to provide additional background or 
supporting examples for specified design recommendations provided in this 
Safety Guide. 
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Annex IT 


ASPECTS TO BE ADDRESSED IN THE DESIGN OF THE FUEL ROD, 
FUEL ASSEMBLY, REACTIVITY CONTROL ASSEMBLY, 
NEUTRON SOURCE ASSEMBLY AND HYDRAULIC PLUG 

ASSEMBLY 


FUEL ROD 


II-1. The design of the fuel rod needs to address the aspects described 
in the following: 


(a) Cladding: 

— Fuel rod vibration and wear (i.e. grid-to-rod fretting wear for light 
water reactors, spacer-to-spacer fretting wear for pressurized heavy 
water reactors); 

— Evolution of the mechanical properties of the cladding with 
irradiation (displacement and pressure driven loadings); 

— Materials and chemical evaluation; 

— Stress corrosion; 

— Cycling and fatigue; 

— Geometrical and chemical stability of the cladding under irradiation. 

(b) Fuel material (including burnable absorbers): 

— Dimensional stability of the fuel under irradiation; 

— Fuel densification (kinetics and amplitude); 

— Potential for chemical interaction with the cladding and the coolant; 

— Fission gas generation and distribution within the fuel pellets; 

— Fission gas release kinetics; 

— Gaseous swelling; 

— Thermomechanical properties under irradiation; 

— Microstructure changes as a function of irradiation. 

(c) Fuel rod performance: 

— Pellet and cladding temperatures and temperature distributions; 

— Fuel-cladding gap closure kinetics and amplitude (to address issues 
relating to pellet-cladding interactions); 

— Irradiation effects on fuel rod behaviour (e.g. fuel restructuring, 
cracking of fuel pellets, solid and gaseous fission product swelling, 
fission gas release and increases m internal pressure of fuel rods, 
degradation of thermal conductivity of fuel rods); 

— Fuel rod bowing; 

— Fuel rod growth. 
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Fuel rod performance is demonstrated using validated analytical models and/or 
representative experimental data collected either in test programmes or from 
other nuclear power plants (lead use fuel rods or lead use fuel assemblies). The 
models used are, generally, burnup dependent. 


FUEL ASSEMBLY 


II-2. Fuel assembly components (e.g. top and bottom nozzles, guide tubes, 
spacers, mixing grids, grid springs, connections and fuel assembly hold-down 
systems for pressurized water reactors) need to be designed to withstand the 
following conditions and loads: 


— Core restraint system loads; 

— Hydrodynamic loads; 

— Thermohydraulic limits (e.g. critical heat flux); 

— Accident loads (e.g. loss of coolant accident) and seismic loads; 
— Handling and shipping loads; 

— Fuel assembly bowing. 


REACTIVITY CONTROL ASSEMBLY 


II-3. The design of the reactivity control assembly needs to address the 
following aspects: 


— Rod internal pressure and related cladding stresses during normal, transient 
and accident conditions; 

— Thermal expansion and irradiation induced swelling; 

— Evolution of absorber materials and the cladding under irradiation; 

— The effect of fretting wear on cladding resistance. 


NEUTRON SOURCE ASSEMBLY 


II-4. The design of the neutron source assembly needs to address the 
following aspects: 


(a) Irradiation effects; 


(b) Efficiency to take into account burnup shadowing effects of peripheral fuel 
assemblies; 
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(c) External events such as earthquakes. 


HYDRAULIC PLUG ASSEMBLY 


II-5. The design of the hydraulic plug assembly needs to address the 
following aspects: 


(a) Interaction with guide tubes due to thermal expansion or irradiation 
induced swelling; 

(b) Impact on coolant bypass flow (for pressurized water reactors); 

(c) The effect of fretting wear on guide tube resistance. 
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